All Apps and Add-ons

How to make Splunk DB Connect 2 escape quotes

marcusnilssonmr
Path Finder

When indexing columns containing quotes ("), Splunk DB Connect 2 does not seem to quote the values:

x=""", x2="1"

The fields are naturally not interpreted correctly..

Is there a way to make Splunk DB Connect 2 escape values?

When using Splunk DB Connect, the format of the line is compatible with KV_MODE auto, key value pairs inside ". Obviously, this format does not work if the values have " in them.

What I want is for Splunk DB Connect to format lines to be compatible with KV_MODE auto_escaped. For this to work, it would need to replace " with \" automatically (and probably linefeeds as well)

Tags (1)
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

have you tried putting a backslash character in front of them?

0 Karma

marcusnilssonmr
Path Finder

That is what I want Splunk DB Connect 2 to do, that app is formatting the event.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...