Splunk Search

Table function is encoding my search results- how can I prevent this from happening?

Klaus_Mueller
Loves-to-Learn

My search is supposed to return some data with double quotes on it but when I use the TABLE function the results displayed are encoded.

Example:

Search:
index=* "america" "PurchaseOrgE"
|rex "Query being run \[(?<Query>(.*?)(?=\]))"
|eval ParsedQuery = replace(Query," AND "," AND ")
|table ParsedQuery

Expected result:
SELECT M2HTab1."SupplierKey.UniqueName" AS "SupplierKey_UniqueName",M2HTab1."Name" 


Current result:

SELECT M2HTab1.&quot;SupplierKey.UniqueName&quot; AS &quot;SupplierKey_UniqueName&quot;,M2HTab1.&quot;Name&quot; 

 
As you can see in the examples the double quotes are encoded making it hard to properly see the results.

Is there a way to prevent this from happening?

 Thanks in advance.

 

 

 

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried the urldecode function?

index=* "america" "PurchaseOrgE"
|rex "Query being run \[(?<Query>(.*?)(?=\]))"
|eval ParsedQuery = urldecode(replace(Query," AND "," AND "))
|table ParsedQuery

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Klaus_Mueller
Loves-to-Learn

Yes,

I did try it but looks like is not the replace function that is causing the data to be encoded and yes the table function.

Unfortunately, It also doesn't work. 

Thanks for the reply.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Which version are you using and what do your events look like?

My tests don't show any form of conversion (either escaping or HTML encoding).

For example, this run-anywhere search

| makeresults 
| eval a="\"a quoted text with \" ' quotes \""
| table a

shows a perfectly good and expected output of

"a quoted text with " ' quotes "

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...