Here is my query...
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user's password changed' -o splunkDataForLast24Hour.csv
Above query fails because of single quote in "user's" string, the query will work if I take out that quote but I want it to be there to find out the exact phrase.
Even placing backslash did not help. Any inputs?
The single quote is being interpreted by curl as the breaker for your opening single quote for the search
. Try escaping the single quote in user's
with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
Just look for “password changed” instead...
The single quote is being interpreted by curl as the breaker for your opening single quote for the search
. Try escaping the single quote in user's
with a backslash wrapped in single quotes. So it will look like this: user'\''s
If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:
curl -ku "user:password" https://myserver.com:8089/services/search/jobs/export --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv
BTW, according to this post (https://stackoverflow.com/questions/32122586/curl-escape-single-quote) you might also have success if you change your single quotes around the search
value to double-quotes and escape the double-quotes within the search using regular backlashes.