Escape character in splunk

[leandromatperei]

Hello friends. I have the log file below and I need to extract exactly the specified value from a line

attr_itx_is_online [int] = 0
attr_itx_is_locked [int] = 0
attr_itx_workbin_type_id [str] = "TESTE"
attr_itx_agent_id [str] = "TESTE_OLSONJU_6628"
attr_itx_received_at [str] = "2020-09-22T17:45:01Z"
attr_itx_submitted_at [str] = "2020-09-22T17:45:51Z"
attr_itx_delivered_at [str] = "2020-09-22T18:47:06Z"
attr_itx_placed_in_queue_at [str] = "2020-09-22T17:46:06Z"

 
I need to capture the values ​​that have this beginning and the date starts with attr_itx_submitted_at [str] ="2020-05"

it's possible ?

[thambisetty]

Events you posted is single event or multi events?

do you want to apply search filter to see only events that are matched with you keyword given by you or you want to extract the value to new field?

[leandromatperei]

Hello, there are multiple events, but what interests me are these events "attr_itx_submitted_at [str] ="

I want to see only the results where this string contains the date 20-05

Attached I am sending you how these events are seen in the log. Tha is, "attr_itx_submitted_at [str] = "2020-05-*""

attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:40:46Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:16Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"
attr_itx_submitted_at [str] = "2020-09-22T19:52:05Z"