How do I escape the ' in Splunk search while running from command line?

[chetanhonnavile]

Here is my query...

curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user's password changed' -o splunkDataForLast24Hour.csv

Above query fails because of single quote in "user's" string, the query will work if I take out that quote but I want it to be there to find out the exact phrase.

Even placing backslash did not help. Any inputs?

[jkat54]

Just look for “password changed” instead...

[elliotproebstel · Accepted solution]

The single quote is being interpreted by curl as the breaker for your opening single quote for the search. Try escaping the single quote in user's with a backslash wrapped in single quotes. So it will look like this: user'\''s

If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:

curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv

[elliotproebstel]

BTW, according to this post (https://stackoverflow.com/questions/32122586/curl-escape-single-quote) you might also have success if you change your single quotes around the search value to double-quotes and escape the double-quotes within the search using regular backlashes.