Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I escape the ' in Splunk search while runni...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is my query...
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user's password changed' -o splunkDataForLast24Hour.csv
Above query fails because of single quote in "user's" string, the query will work if I take out that quote but I want it to be there to find out the exact phrase.
Even placing backslash did not help. Any inputs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The single quote is being interpreted by curl as the breaker for your opening single quote for the search. Try escaping the single quote in user's with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just look for “password changed” instead...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The single quote is being interpreted by curl as the breaker for your opening single quote for the search. Try escaping the single quote in user's with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW, according to this post (https://stackoverflow.com/questions/32122586/curl-escape-single-quote) you might also have success if you change your single quotes around the search value to double-quotes and escape the double-quotes within the search using regular backlashes.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
