Archive

Field value getting " "

New Member

Hi All,

Need help, here is the scenario

index=test subject="hello world" >>> getting the output

index=test subject="hello "world" test" >> not getting the output , reason is due to addtional "" (sometimes we are getting this in field values)

Any suggestion to pick these values of field subject.

Tags (1)
0 Karma

Champion

try searching index=test subject="hello \"world\" test"

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!