Splunk Search

Table Different from Return

Builder

Hello,
I don't understand why the values in my | table are different from the values in my | return.... | format commands. Note: the searches are identical except for the last commands.

search... | table localrefid, token

localrefid  token
56499548      ad76eb26-5ead-45d9-8a21-45a7a42894db

search... | return 10000000 localrefid, token

( ( "(localrefid=\"56499548\" token=\"ad76eb26-5ead-45d9-8a21-45a7a42894db\") OR (localrefid.........

What I need is

 ( ( "(localrefid=56499548 token=ad76eb26-5ead-45d9-8a21-45a7a42894db) OR (localrefid.........

Where are the backslashes and quotes coming from as they do not show up in the table? How do I delete them?

Thanks and God bless,
Genesius

0 Karma
1 Solution

Esteemed Legend

Like this:

search... 
| table localrefid token
| format

View solution in original post

0 Karma

Esteemed Legend

Like this:

search... 
| table localrefid token
| format

View solution in original post

0 Karma

Builder

@woodcock
Thanks.
That removed the backslashes. But the double quotes remain.

( ( localrefid="56499548" AND token="ad76eb26-5ead-45d9-8a21-45a7a42894db" ) OR ( localrefid=

Once the double quotes are gone, this table of results needs to be the values used in an upper? search.
The search is the same as previously, except these events have LOCALREFID and TOKEN. I need to find events where LOCALREFID = localrefid AND TOKEN = token.

BTW. Removing the backslashes was so simple. Why does SPL add those backslashes and quotes?

God bless,
Genesius

0 Karma

Builder

@woodcock
I was able to find the following Answers post for my followup question above. Not sure why this isn't better stated in the Splunk Docs.

link text

Thanks again for your help.
God bless,
Genesius

Esteemed Legend

Make sure to UpVote both the OP and @cmerriman in that link.

0 Karma

Esteemed Legend

If your field values contain double-quotes, it will have to escape them when it adds double-quotes around the values. Don't forget to click Accept to close the question.

0 Karma

Builder

@woodcock
Thanks again. I accepted your answer, and upvoted cmerriman post as well.
God bless,
Genesius