Splunk Search

How to include quote within LIKE keyword in Dbxquery?

LearningGuy
Motivator

how to include quote within LIKE keyword in Dbxquery?
For example:    There are 10k people in the DB and I would like to query only those who contains number:123
The problem is the content has quote ".   Note I cannot filter only 123 because it will also match another record.  
name = person1
content = {"description:"test",number":123,"status":"good"}

| dbxquery connection = visibility query = "select name, content from TestDB where content like '%number":123%'

Thanks

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried escaping the quotation mark?  Just a guess.

| dbxquery connection = visibility query = "select name, content from TestDB where content like '%number\":123%'"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...