Splunk AppDynamics

Escaped double quotes in HTTP template

CommunityUser
Splunk Employee
Splunk Employee

Hi,

Recently I found that the ${latestEvent.summaryMessage} and ${latestEvent.eventMessage} of Mobile App New Crash events will contains double quote " in the message.

This will broke our HTTP template which try to form HTTP payload in JSON format.

May I know how we can escape the double quote of the ${latestEvent.summaryMessage} and ${latestEvent.eventMessage} value?

Our payload template is somethings like:

{

    "summaryMessage": "${latestEvent.summaryMessage}",
    "eventMessage": "${latestEvent.eventMessage}",

    ...

}

Thank you.

Regards,

Jen

Labels (3)
Tags (1)
0 Karma
1 Solution

Atyuha_Pal
Contributor

Hi Jen,


Can you try 

'$esc.java(${latestEvent.summaryMessage})' 

Reference: https://velocity.apache.org/tools/2.0/apidocs/org/apache/velocity/tools/generic/EscapeTool.html

You should have single quotes surrounding the key and values in json payload.

If it doesnt work try - $!{latestEvent.summaryMessage.replace('"',"")}

Thanks,

Atyuha

View solution in original post

0 Karma

Atyuha_Pal
Contributor

Hi Jen,


Can you try 

'$esc.java(${latestEvent.summaryMessage})' 

Reference: https://velocity.apache.org/tools/2.0/apidocs/org/apache/velocity/tools/generic/EscapeTool.html

You should have single quotes surrounding the key and values in json payload.

If it doesnt work try - $!{latestEvent.summaryMessage.replace('"',"")}

Thanks,

Atyuha

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Finally I tested below is working:

{ "summaryMessage": "$!{latestEvent.summaryMessage.replace('"','')}" }

Thanks a lot!

CommunityUser
Splunk Employee
Splunk Employee

This was really helpful, thanks!

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Atyuda,

Thanks for the reply.

I tried with

{

#set ($newSummary = '$esc.java(${latestEvent.summaryMessage})')

"summaryMessage": "$newSummary"

}

and it returns the payload exactly with "summaryMessage": "$newSummary" 

I tried with:

{ "summaryMessage": "${latestEvent.summaryMessage}.replace('"','')" }

but return the same error "SyntaxError: Unexpected token R" which seems unable to convert the double quote.

No luck to successfully escpae the double quote so far.

The endpoint required the message to be send in a JSON format which is a double quote format.

Thus I try to set the variable first then only assign it in the json payload but doesn't seems to make it works.

Have you able to send out a HTTP template in JSON format that can escape the double quotes?

Regards,

Jen

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...