Table Different from Return

[genesiusj]

Hello,
I don't understand why the values in my | table are different from the values in my | return.... | format commands. Note: the searches are identical except for the last commands.

search... | table localrefid, token

localrefid  token
56499548      ad76eb26-5ead-45d9-8a21-45a7a42894db

search... | return 10000000 localrefid, token

( ( "(localrefid=\"56499548\" token=\"ad76eb26-5ead-45d9-8a21-45a7a42894db\") OR (localrefid.........

What I need is

 ( ( "(localrefid=56499548 token=ad76eb26-5ead-45d9-8a21-45a7a42894db) OR (localrefid.........

Where are the backslashes and quotes coming from as they do not show up in the table? How do I delete them?

Thanks and God bless,
Genesius

[woodcock · Accepted solution]

Like this:

search... 
| table localrefid token
| format

[genesiusj]

@woodcock
Thanks.
That removed the backslashes. But the double quotes remain.

( ( localrefid="56499548" AND token="ad76eb26-5ead-45d9-8a21-45a7a42894db" ) OR ( localrefid=

Once the double quotes are gone, this table of results needs to be the values used in an upper? search.
The search is the same as previously, except these events have LOCALREFID and TOKEN. I need to find events where LOCALREFID = localrefid AND TOKEN = token.

BTW. Removing the backslashes was so simple. Why does SPL add those backslashes and quotes?

God bless,
Genesius

[genesiusj]

@woodcock
I was able to find the following Answers post for my followup question above. Not sure why this isn't better stated in the Splunk Docs.

link text

Thanks again for your help.
God bless,
Genesius

[woodcock]

Make sure to UpVote both the OP and @cmerriman in that link.

[woodcock]

If your field values contain double-quotes, it will have to escape them when it adds double-quotes around the values. Don't forget to click Accept to close the question.

[genesiusj]

@woodcock
Thanks again. I accepted your answer, and upvoted cmerriman post as well.
God bless,
Genesius