Hello,
I don't understand why the values in my | table are different from the values in my | return.... | format commands. Note: the searches are identical except for the last commands.
search... | table localrefid, token
localrefid token
56499548 ad76eb26-5ead-45d9-8a21-45a7a42894db
search... | return 10000000 localrefid, token
( ( "(localrefid=\"56499548\" token=\"ad76eb26-5ead-45d9-8a21-45a7a42894db\") OR (localrefid.........
What I need is
( ( "(localrefid=56499548 token=ad76eb26-5ead-45d9-8a21-45a7a42894db) OR (localrefid.........
Where are the backslashes and quotes coming from as they do not show up in the table? How do I delete them?
Thanks and God bless,
Genesius
Like this:
search...
| table localrefid token
| format
@woodcock
Thanks.
That removed the backslashes. But the double quotes remain.
( ( localrefid="56499548" AND token="ad76eb26-5ead-45d9-8a21-45a7a42894db" ) OR ( localrefid=
Once the double quotes are gone, this table of results needs to be the values used in an upper? search.
The search is the same as previously, except these events have LOCALREFID and TOKEN. I need to find events where LOCALREFID = localrefid AND TOKEN = token.
BTW. Removing the backslashes was so simple. Why does SPL add those backslashes and quotes?
God bless,
Genesius
@woodcock
I was able to find the following Answers post for my followup question above. Not sure why this isn't better stated in the Splunk Docs.
Thanks again for your help.
God bless,
Genesius
Make sure to UpVote
both the OP and @cmerriman in that link.
If your field values contain double-quotes, it will have to escape them when it adds double-quotes around the values. Don't forget to click Accept
to close the question.
@woodcock
Thanks again. I accepted your answer, and upvoted cmerriman post as well.
God bless,
Genesius