Search with special characters

[ToniHuynh]

Hi everyone,

I have trouble to decode the token which contains some special character such as (). Below is my search and it does not return any result because the ObjectName contains the () in it:

index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" 
| eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") 
| eval ObjectName=replace(ObjectName,"\\\\","\\\\\\")
| where match(Object_Name,ObjectName) 
| dedup _time host Account_Name Account_Domain Object_Name Accesses EventCodeDescription
| timechart span=60m count(Object_Name) as Changes by Account_Name

If the ObjectName does not contain () then it will work well. Could anyone help me decode it?

Thanks,

Toni

[thambisetty]

The best of way of searching value from Splunk is to select the string if it's not part of any field to add to search, it will automatically escape special characters. if the value is in field you can just click on field and select the value you would like to search. you can then use the selected value present in search where ever you want to use in the search.

[yeahnah]

Hi @ToniHuynh 

If you see no results with the () then I suspect the where clause may be at fault and would start debugging around there.  So...

index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" 
| eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") 
| eval ObjectName=replace(ObjectName,"\\\\","\\\\\\")
| where match(Object_Name,ObjectName) 
| table Object_Name ObjectName

If no results then change the where to negate the match, i.e. | where NOT match(....

If you get results now then the match function obviously consider the Object* fields are different so carefully compare each Object column for potential differences.  You may then need to add some more eval statements to make ObjectName exactly align with Object_Name.

That's where I'd start anyway.  Hope it helps.
Carefully compare the column outputs