Splunk Enterprise

Escape quote in standard input?

stefano339
Engager

Hello. I have a input script in python that gets data from db and puts them in stdin in the form field = "value". One field contains a json so I tried to escape quotes:
field = "{\"id\": \"a\"}"
but what I get in the field is "{\" losing the rest.
There is a way to escape quote in this case?
Thanks

Tags (2)
0 Karma
1 Solution

stefano339
Engager

Yes I did but is was non working until I found out to use auto_escaped instead of auto as KV_MODE.
Now it's working fine.
Thanks

View solution in original post

0 Karma

stefano339
Engager

Yes I did but is was non working until I found out to use auto_escaped instead of auto as KV_MODE.
Now it's working fine.
Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried field = '{\"id\": \"a\"}'?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...