I don't understand why the values in my | table are different from the values in my | return.... | format commands. Note: the searches are identical except for the last commands.
search... | table localrefid, token
localrefid token 56499548 ad76eb26-5ead-45d9-8a21-45a7a42894db
search... | return 10000000 localrefid, token
( ( "(localrefid=\"56499548\" token=\"ad76eb26-5ead-45d9-8a21-45a7a42894db\") OR (localrefid.........
What I need is
( ( "(localrefid=56499548 token=ad76eb26-5ead-45d9-8a21-45a7a42894db) OR (localrefid.........
Where are the backslashes and quotes coming from as they do not show up in the table? How do I delete them?
Thanks and God bless,
That removed the backslashes. But the double quotes remain.
( ( localrefid="56499548" AND token="ad76eb26-5ead-45d9-8a21-45a7a42894db" ) OR ( localrefid=
Once the double quotes are gone, this table of results needs to be the values used in an upper? search.
The search is the same as previously, except these events have LOCALREFID and TOKEN. I need to find events where LOCALREFID = localrefid AND TOKEN = token.
BTW. Removing the backslashes was so simple. Why does SPL add those backslashes and quotes?
I was able to find the following Answers post for my followup question above. Not sure why this isn't better stated in the Splunk Docs.
Thanks again for your help.
If your field values contain double-quotes, it will have to escape them when it adds double-quotes around the values. Don't forget to click
Accept to close the question.