topic Re: How to replace backslash by double backslash using eval in search and props.conf in Splunk Enterprise

How to replace backslash by double backslash using eval in search and props.conf

jay — Thu, 23 Jul 2020 06:04:19 GMT

for example : C:\user\process --> C:\\user\\process

manan_amin — Thu, 23 Jul 2020 06:11:50 GMT

In Eval, We can use string format function (replace) to replace "\" by two "\\".

Here, We need to escape "\" two times,

One of the way to replace it,

props.conf

EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")

in Search Query:

| eval new_path = replace(path ,"(\\\\)","\\\\\1")

highsplunker — Thu, 17 Oct 2024 12:47:49 GMT

why 4 backslashes?