Splunk Search

Search for result with double quotes

hendrkle
New Member

Hello,

I'm new to Splunk and am search for an event that would include this:

toState: "stateB",", fromState: "stateA"

Since the result has double quotes, if I use the above as a search, it will include a variety of events that I don't want to see because it doesn't take it as one string.

Any advice you could offer?

Tags (1)
0 Karma
1 Solution

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

View solution in original post

0 Karma

rlshep
New Member

The search string should be

"toState: \"stateB\",\", fromState: \"stateA\""

0 Karma

apakhomov
Path Finder

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""


Best regards,
Artem.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I downvoted this post because the correct syntax should have only one backslash escape.

0 Karma

apakhomov
Path Finder

Please, check the case of letters. StateA and stateA are different conditions for the system.

0 Karma

hendrkle
New Member

Thanks Artem,

Using your suggestion, I get zero events back, even if I simply it like this:

"fromState: \"StateA\""

Any idead why this may be?

fromState is in a a huge string and I cannot use it as a field (I think).

Thanks

0 Karma

apakhomov
Path Finder

However I would better suppose to extract the fields toState and formState. After extracting you will be able to use search string:
toState=stateB fromState=stateA

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...