Splunk Search

If I have a field value with double quotes, how do I get a Splunk search to ignore the double quotes to display the entire value?

tdiestel
Path Finder

HI All;

I have data which contains many events like this:

event_name="test"
action_name="widgets_panel"
action_params="{"content_source":"news_and_media"}"

When I do a command like this ...|table event_name action_name action_params, the results look like this: test, widgets_panel, {

I see that the double quotes in the action_params is causing this issue, and my question here is, "is there a work around to pull in all of {"content_source":"news_and_media"} when I call the action_param field?"

Thanks,
Tyler

0 Karma

nnmiller
Contributor

Looking at some of the other JSON answers, I tried setting KV_MODE=auto_escaped but that did not eliminate the issue in my testing.
So you'll need to set up field extractions as somesoni2 suggested.

Example (assuming data above is the exact event format):

^(?:[^=\n]*=){3}(?P<actionparams>.+)

You'll have to adjust the regex if there's more data following the action_params KV pair that has similar KV pairs to extract.

If you have the option to modify the log format of these messages, it seems like the best way would be to remove the quotes before the brackets. That turns the events into legal JSON, so they should be automatically extracted.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You'd probably have to setup custom field extractions. Can you provide some sample events, keeping original line breaks?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...