Splunk Search

How do I escape single quote within DBXquery SQL like command?

LearningGuy
Motivator

how do I escape single quote within DBXquery SQL like command
For example:   
content = '. . . . . .  src_port': 20, 'dst_port': 21     .....   '  there is space after colon :
| dbxquery connection=visibility query="select  content from DB where content like '%port\'\:\s20\,' "
This query gave me an error.  I already tried to escape single quote with single quote, but did gave me 0 result

Thanks

Labels (2)
Tags (2)
0 Karma

tscroggins
SplunkTrust
SplunkTrust

Hi,

Escape sequences vary by SQL implementation, but generally, an apostrophe can be included in a character string with a preceding apostrophe, e.g.:

SELECT 'FOO''BAR'

returns FOO'BAR, where the double apostrophe is replaced with a single apostrophe.

In your example:

| dbxquery connection=visibility query="select content from DB where content like '%port'': 20,' "

will return the content column from all DB table rows where content ends with port':[space]20,'[space].

To find all rows containing a src_port or dest_port string (or any other _port': string), you might try:

| dbxquery connection=visibility query="select content from DB where content like '''%\_port'':%' escape '\'"

In LIKE predicate patterns, % and _ are wildcards. I've introduced the ESCAPE clause to explicitly define an escape character.

LIKE predicate patterns are not regular expressions, so you may match more than you intended.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...