Splunk Base : SplunkGeneral : #3749

Splunk bug with backslash and quotes - escape character \

msallman — Tue, 16 Mar 2010 06:01:01 PDT

I just upgaded to 4.0.10 and that seems to have fixed the problems I was having with the escaping & quoting.
Thanks.

Splunk bug with backslash and quotes - escape character \

jerrybrennock2 — Fri, 05 Mar 2010 12:14:39 PST

This is serious problem for me. I just noticed that I was missing alerts on a whole class of errors. Are there any workarounds or expectations as to when this will be fixed?

Splunk bug with backslash and quotes - escape character \

rachel — Thu, 11 Feb 2010 18:01:34 PST

yeah, i know :)

Splunk bug with backslash and quotes - escape character \

araitz — Thu, 11 Feb 2010 16:25:12 PST

LOL @ us for fixing the issue with NOT but not fixing the other issues :D

Splunk bug with backslash and quotes - escape character \

rachel — Thu, 11 Feb 2010 14:07:05 PST

my understanding is that parts of the problem were fixed in 4.0.9--specifically queries with "NOT" in them. initially (when writing the release notes for 4.0.9), i thought the bugfix applied to the entire issue, but it didn't.

Splunk bug with backslash and quotes - escape character \

msallman — Thu, 11 Feb 2010 13:26:00 PST

Ok, thanks.

Splunk bug with backslash and quotes - escape character \

araitz — Thu, 11 Feb 2010 12:31:12 PST

The problem is not fixed in 4.0.9, I can confirm this. I believe the issue is supposed to be re-fixed in 4.0.10, I will try to confirm that this is the case.

Splunk bug with backslash and quotes - escape character \

gkanapathy — Thu, 11 Feb 2010 11:58:31 PST

they're not available publicly. it would be helpful to have an example of a query that behaves that way, and you can either open a support case with it (it should be easy enough to verify it's a bug) or you post it here.

Splunk bug with backslash and quotes - escape character \

msallman — Thu, 11 Feb 2010 11:30:17 PST

Are those issues accessible anywhere on the website?
It seems from the descriptions in the release notes that it just affected "NOT" queries? Or that those were the only ones that were fixed?
The reason I ask is that we have a couple of queries that broke with the same problem (extra escaping of quotes and/or extra quotes, though ours doesn't have any "NOT"s). I just upgraded to 4.0.9 and the problem doesn't seem to have been fixed. For us, anyway. :-)

Splunk bug with backslash and quotes - escape character \

gkanapathy — Thu, 11 Feb 2010 10:18:11 PST

Looks like yes: http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.0.9

Splunk bug with backslash and quotes - escape character \

msallman — Thu, 11 Feb 2010 09:33:04 PST

Is this one of the issues (SPL-26944, SPL-28136, SPL-28640) that were fixed in release 4.0.9?

Splunk bug with backslash and quotes - escape character \

araitz — Wed, 16 Dec 2009 14:48:50 PST

Nope, you did everything right! I will try to remember to update this post when the bug is fixed, but to be extra sure you can email support at splunk dot com, let them know you are having the issue and ask them to let you know when it is fixed.

Splunk bug with backslash and quotes - escape character \

scarolan108 — Wed, 16 Dec 2009 13:54:18 PST

Ok, just wanted to make sure I wasn't doing something wrong.

Splunk bug with backslash and quotes - escape character \

araitz — Wed, 16 Dec 2009 13:44:28 PST

This is a known issue and should be fixed in an upcoming service release - sorry for the inconvenience, it bugs me too!

Splunk bug with backslash and quotes - escape character \

scarolan108 — Wed, 16 Dec 2009 12:38:50 PST

I have a relatively simple search, which includes a phrase enclosed in double quotes. For example:

error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) ) NOT "illegal user"

When I type in the search manually it works fine. When I save it Splunk inserts escape characters before each of the quotes, so that the next time I pull up the search it fails and shows zero results. I have to manually delete the backslashes to get it to work again. Older versions of splunk did not do this.

Please let me know what I need to do to fix this. It's extremely annoying to have to delete the backslashes each time.