Splunk Search

Search returns no result when including a ()

ToniHuynh
Explorer

Hi everyone,

I have trouble to decode the token which contains some special character such as (). Below is my search and it does not return any result because the ObjectName contains the () in it:

 

 

index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" 
| eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") 
| eval ObjectName=replace(ObjectName,"\\\\","\\\\\\")
| where match(Object_Name,ObjectName) 
| dedup _time host Account_Name Account_Domain Object_Name Accesses EventCodeDescription
| timechart span=60m count(Object_Name) as Changes by Account_Name

 

 

If the ObjectName does not contain () then it will work well. Could anyone help me decode it?

Thanks,

Toni

 

Labels (1)
0 Karma

renjith_nair
Legend

Are you facing the issue in a dashboard token or in the search itself. Tried with the below sample search and it works fine and able to compare

 

|makeresults|eval ObjectName="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg"
|eval object_name="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg"
|eval status=if(ObjectName == object_name,"Equal","Not Equal")

Please let us know where exactly the search failing .

If Search with special characters also for the same issue, you may delete/close that post

 

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...