Splunk Search

Search for result with double quotes

hendrkle
New Member

Hello,

I'm new to Splunk and am search for an event that would include this:

toState: "stateB",", fromState: "stateA"

Since the result has double quotes, if I use the above as a search, it will include a variety of events that I don't want to see because it doesn't take it as one string.

Any advice you could offer?

Tags (1)
0 Karma
1 Solution

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

View solution in original post

0 Karma

rlshep
New Member

The search string should be

"toState: \"stateB\",\", fromState: \"stateA\""

0 Karma

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I downvoted this post because the correct syntax should have only one backslash escape.

0 Karma

apakhomov
Path Finder

Please, check the case of letters. StateA and stateA are different conditions for the system.

0 Karma

hendrkle
New Member

Thanks Artem,

Using your suggestion, I get zero events back, even if I simply it like this:

"fromState: \"StateA\""

Any idead why this may be?

fromState is in a a huge string and I cannot use it as a field (I think).

Thanks

0 Karma

apakhomov
Path Finder

However I would better suppose to extract the fields toState and formState. After extracting you will be able to use search string:
toState=stateB fromState=stateA

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...