Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do I escape the ' in Splunk search while r...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is my query...
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user's password changed' -o splunkDataForLast24Hour.csv
Above query fails because of single quote in "user's" string, the query will work if I take out that quote but I want it to be there to find out the exact phrase.
Even placing backslash did not help. Any inputs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The single quote is being interpreted by curl as the breaker for your opening single quote for the search. Try escaping the single quote in user's with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just look for “password changed” instead...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The single quote is being interpreted by curl as the breaker for your opening single quote for the search. Try escaping the single quote in user's with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW, according to this post (https://stackoverflow.com/questions/32122586/curl-escape-single-quote) you might also have success if you change your single quotes around the search value to double-quotes and escape the double-quotes within the search using regular backlashes.
Prove Your Splunk Prowess at .conf25—No Prereqs Required!
Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code
Splunk Answers Content Calendar, July Edition I
