Splunk Search

Search for result with double quotes

hendrkle
New Member

Hello,

I'm new to Splunk and am search for an event that would include this:

toState: "stateB",", fromState: "stateA"

Since the result has double quotes, if I use the above as a search, it will include a variety of events that I don't want to see because it doesn't take it as one string.

Any advice you could offer?

Tags (1)
0 Karma
1 Solution

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

View solution in original post

0 Karma

rlshep
New Member

The search string should be

"toState: \"stateB\",\", fromState: \"stateA\""

0 Karma

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I downvoted this post because the correct syntax should have only one backslash escape.

0 Karma

apakhomov
Path Finder

Please, check the case of letters. StateA and stateA are different conditions for the system.

0 Karma

hendrkle
New Member

Thanks Artem,

Using your suggestion, I get zero events back, even if I simply it like this:

"fromState: \"StateA\""

Any idead why this may be?

fromState is in a a huge string and I cannot use it as a field (I think).

Thanks

0 Karma

apakhomov
Path Finder

However I would better suppose to extract the fields toState and formState. After extracting you will be able to use search string:
toState=stateB fromState=stateA

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...