Splunk Search

How to include double quotes in Switch Case

Anantha123
Communicator

Hi All,

How can I do switch case for below values
{"XXX":["ABC"]} == ABC
{"XXX":[]} == NULL .

| eval Name=case(Name == "{"XXX":[]}", "NULL", Name == "{"XXX":["ABC"]}", "ABC" ) - This is not working.

Thanks in Advance.

Tags (1)
0 Karma
1 Solution

tscroggins
Motivator

Splunk uses C-style escape sequences in strings. Escape the inner quotation marks with a backslash:

| eval Name=case(Name == "{\"XXX\":[]}", "NULL", Name == "{\"XXX\":[\"ABC\"]}", "ABC" )

View solution in original post

0 Karma

tscroggins
Motivator

Splunk uses C-style escape sequences in strings. Escape the inner quotation marks with a backslash:

| eval Name=case(Name == "{\"XXX\":[]}", "NULL", Name == "{\"XXX\":[\"ABC\"]}", "ABC" )

0 Karma

Anantha123
Communicator

Thank you. It works.

0 Karma