Splunk Search

Search returns no result when including a ()

ToniHuynh
Explorer

Hi everyone,

I have trouble to decode the token which contains some special character such as (). Below is my search and it does not return any result because the ObjectName contains the () in it:

 

 

index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" 
| eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") 
| eval ObjectName=replace(ObjectName,"\\\\","\\\\\\")
| where match(Object_Name,ObjectName) 
| dedup _time host Account_Name Account_Domain Object_Name Accesses EventCodeDescription
| timechart span=60m count(Object_Name) as Changes by Account_Name

 

 

If the ObjectName does not contain () then it will work well. Could anyone help me decode it?

Thanks,

Toni

 

Labels (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Are you facing the issue in a dashboard token or in the search itself. Tried with the below sample search and it works fine and able to compare

 

|makeresults|eval ObjectName="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg"
|eval object_name="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg"
|eval status=if(ObjectName == object_name,"Equal","Not Equal")

Please let us know where exactly the search failing .

If Search with special characters also for the same issue, you may delete/close that post

 

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...