Splunk Search

Search for splunk event which has greater than symbol

sasank
Explorer

Hi,

I have a Splunk event "Application -> start of the log".

When I try to search for this log using the exact text then I do not get any results.

I see that the greater than symbol is causing the problem. When I split my search command as "Application -" AND "start of the log" then splunk was able to find the event.

So how do I escape the greater than symbol in splunk search command? I tried > which didn't work.

(I also want to use this search text in "transaction startswith=" command so I cannot use `AND` condition)

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I have no problems searching for the '>' character.

richgalloway_0-1671918775323.png

Please share your exact SPL and a sample event so we have a better view of the problem.  What version of Splunk are you using?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I have no problems searching for the '>' character.

richgalloway_0-1671918775323.png

Please share your exact SPL and a sample event so we have a better view of the problem.  What version of Splunk are you using?

---
If this reply helps you, Karma would be appreciated.

sasank
Explorer

Hi, I saw the RAW event and found that the text in the event is "Application -\u003e start of the log"

The greater than symbol is in unicode.

So I have to search as "Application -\\u003e start of the log".

Thank you.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...