12

Splunk best practices say to use key/value pairs. It also says to wrap values in quotes if they contain spaces. So, let's say I have a raw value of Fred Smith:

my_key=name my_value="Fred Smith"

That's fine, I've added the quotes. But what if I have a raw value of " Fred Smith" (note the quotes already present and the presence of a space at the start) - this would yield:

my_key=name my_value="" Fred Smith""

This would be treated as:

my_key=name my_value=""
my_key=Fred my_value=Smith""

What are the best practices for escaping quotes in Splunk values?

Steve Dunn
  • 21,044
  • 11
  • 62
  • 87

2 Answers2

9

If you control the data format, which it appears you do, your options include:

  • Add single quotes around everything.
  • Use double-quotes, but escape the inner ones with backslashes
  • Use JSON to represent the data instead of a flat string of KV pairs. JSON syntax handles this quoting case (without adding extra quote marks), plus you can add nested structure if you want.

You can control the search-time field extraction behavior by setting KV_MODE. You may find that auto_escaped will do the trick. See Setting KV_MODE for search-time data in the Splunk Knowledge Manager manual.

halr9000
  • 9,879
  • 5
  • 33
  • 34
0

Try "my_value=\"Fred Smith". Key and value between double quotes but the intern double quote with escape \".

Rodrigo Araujo
  • 1,062
  • 1
  • 9
  • 8