Splunk Search

Splunk SDK - Search String with parameter having Spaces

duddukuri
Explorer

By using Splunk SDK, able to use the below search string and get the results from SPlunk
String searchQuery_string = "search * | head 100";

We have a field by name message in Splunk, which can have values with spaces.
Example message 1 : "Started initialization"
Example message 2 : "Completed initialization in 86 ms"

We want to run search with the message="Completed i*"
In Splunk UI search this is working fine and giving results

When tried with below as the Query string, ZERO Results
String searchQuery_string = "search message='Completed i*'";
String searchQuery_string = "search message=Completed%20i*";

Kindly help me in this regard

Tags (1)
0 Karma
1 Solution

duddukuri
Explorer

normal Java escape character () worked
String searchQuery_string = "search message=\"Completed i*\"";

View solution in original post

0 Karma

duddukuri
Explorer

normal Java escape character () worked
String searchQuery_string = "search message=\"Completed i*\"";

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...