topic Re: Colon Character in JS in Splunk Enterprise

Why is Colon Character in JS not working?

rkeq0515 — Tue, 26 Jul 2022 19:54:31 GMT

I am trying to use a colon ( : ) in my js file; however, I do not see results when I use the colon. I verified that the command works with the colon when I run it within a Search window. I also have it working without the colon in the js file. I just can't seem to use the colon in the js file.

The following code in my js file does not work.

... | search (path IN (\"*:\\windows\\*\")) | stats count

The following code in my js file works.

... | search (path IN (\"*\\windows\\*\")) | stats count

I tried to escape it like I did the double-quotes, but that did not work. Is there a way to use the colon in the js file?

Thanks

Re: Colon Character in JS

VatsalJagani — Tue, 26 Jul 2022 18:47:36 GMT

@rkeq0515 - I always try multiple try-and-error when dealing with \ (backward slash).

One of these should work:

... | search path IN (\"*:\\windows\\*\") | stats count

... | search path IN (\"*:\\\windows\\\*\") | stats count

... | search path IN (\"*:\\\\windows\\\\*\") | stats count

(3 or 4 slashes should work)

I hope this helps!!!

Re: Colon Character in JS

rkeq0515 — Tue, 26 Jul 2022 19:44:43 GMT

Thank you! The 4 back slashes worked. I was focused on the colon since 2 back slashes were working. However, I see that it wasn't providing the correct data.