Splunk AppDynamics

Escaped double quotes in HTTP template

CommunityUser
Splunk Employee
Splunk Employee

Hi,

Recently I found that the ${latestEvent.summaryMessage} and ${latestEvent.eventMessage} of Mobile App New Crash events will contains double quote " in the message.

This will broke our HTTP template which try to form HTTP payload in JSON format.

May I know how we can escape the double quote of the ${latestEvent.summaryMessage} and ${latestEvent.eventMessage} value?

Our payload template is somethings like:

{

    "summaryMessage": "${latestEvent.summaryMessage}",
    "eventMessage": "${latestEvent.eventMessage}",

    ...

}

Thank you.

Regards,

Jen

Labels (3)
Tags (1)
0 Karma
1 Solution

Atyuha_Pal
Contributor

Hi Jen,


Can you try 

'$esc.java(${latestEvent.summaryMessage})' 

Reference: https://velocity.apache.org/tools/2.0/apidocs/org/apache/velocity/tools/generic/EscapeTool.html

You should have single quotes surrounding the key and values in json payload.

If it doesnt work try - $!{latestEvent.summaryMessage.replace('"',"")}

Thanks,

Atyuha

View solution in original post

0 Karma

Atyuha_Pal
Contributor

Hi Jen,


Can you try 

'$esc.java(${latestEvent.summaryMessage})' 

Reference: https://velocity.apache.org/tools/2.0/apidocs/org/apache/velocity/tools/generic/EscapeTool.html

You should have single quotes surrounding the key and values in json payload.

If it doesnt work try - $!{latestEvent.summaryMessage.replace('"',"")}

Thanks,

Atyuha

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Finally I tested below is working:

{ "summaryMessage": "$!{latestEvent.summaryMessage.replace('"','')}" }

Thanks a lot!

CommunityUser
Splunk Employee
Splunk Employee

This was really helpful, thanks!

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Atyuda,

Thanks for the reply.

I tried with

{

#set ($newSummary = '$esc.java(${latestEvent.summaryMessage})')

"summaryMessage": "$newSummary"

}

and it returns the payload exactly with "summaryMessage": "$newSummary" 

I tried with:

{ "summaryMessage": "${latestEvent.summaryMessage}.replace('"','')" }

but return the same error "SyntaxError: Unexpected token R" which seems unable to convert the double quote.

No luck to successfully escpae the double quote so far.

The endpoint required the message to be send in a JSON format which is a double quote format.

Thus I try to set the variable first then only assign it in the json payload but doesn't seems to make it works.

Have you able to send out a HTTP template in JSON format that can escape the double quotes?

Regards,

Jen

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...