Splunk Search

If I have a field value with double quotes, how do I get a Splunk search to ignore the double quotes to display the entire value?

Path Finder

HI All;

I have data which contains many events like this:


When I do a command like this ...|table event_name action_name action_params, the results look like this: test, widgets_panel, {

I see that the double quotes in the action_params is causing this issue, and my question here is, "is there a work around to pull in all of {"content_source":"news_and_media"} when I call the action_param field?"


0 Karma


Looking at some of the other JSON answers, I tried setting KV_MODE=auto_escaped but that did not eliminate the issue in my testing.
So you'll need to set up field extractions as somesoni2 suggested.

Example (assuming data above is the exact event format):


You'll have to adjust the regex if there's more data following the action_params KV pair that has similar KV pairs to extract.

If you have the option to modify the log format of these messages, it seems like the best way would be to remove the quotes before the brackets. That turns the events into legal JSON, so they should be automatically extracted.

0 Karma

Revered Legend

You'd probably have to setup custom field extractions. Can you provide some sample events, keeping original line breaks?

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...