https://community.splunk.com/t5/Getting-Data-In/Remove-characters-during-search-time-extraction/m-p/578512#M102147 <P>Requesting assistance with removing characters from logs during search time.&nbsp;</P><P>Sample Data:&nbsp;</P><P>"<SPAN>{"</SPAN><SPAN class="">log</SPAN><SPAN>"</SPAN><SPAN class="">:</SPAN><SPAN>"{</SPAN><SPAN class="">\</SPAN><SPAN>"</SPAN><SPAN class="">@t\</SPAN><SPAN>"</SPAN><SPAN class=""><span class="lia-unicode-emoji" title=":confused_face:">😕</span></SPAN><SPAN>"</SPAN><SPAN class="">2021-12-15T16:26:36.1571090Z\</SPAN><SPAN>",</SPAN><SPAN class="">\</SPAN><SPAN>"</SPAN><SPAN class="">@m\</SPAN><SPAN>"</SPAN><SPAN class=""><span class="lia-unicode-emoji" title=":confused_face:">😕</span></SPAN><SPAN>"</SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class="">http\\\</SPAN><SPAN>" </SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class="">GET\\\</SPAN><SPAN>" </SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class=""><SPAN class="">/api/v1/"</SPAN></SPAN></P><P><SPAN class=""><SPAN class="">Trying to remove the extra \ \\ that came with the data via HEC.</SPAN></SPAN></P> Wed, 15 Dec 2021 16:50:19 GMT parkertctr 2021-12-15T16:50:19Z https://community.splunk.com/t5/Getting-Data-In/Remove-characters-during-search-time-extraction/m-p/578512#M102147 <P>Requesting assistance with removing characters from logs during search time.&nbsp;</P><P>Sample Data:&nbsp;</P><P>"<SPAN>{"</SPAN><SPAN class="">log</SPAN><SPAN>"</SPAN><SPAN class="">:</SPAN><SPAN>"{</SPAN><SPAN class="">\</SPAN><SPAN>"</SPAN><SPAN class="">@t\</SPAN><SPAN>"</SPAN><SPAN class=""><span class="lia-unicode-emoji" title=":confused_face:">😕</span></SPAN><SPAN>"</SPAN><SPAN class="">2021-12-15T16:26:36.1571090Z\</SPAN><SPAN>",</SPAN><SPAN class="">\</SPAN><SPAN>"</SPAN><SPAN class="">@m\</SPAN><SPAN>"</SPAN><SPAN class=""><span class="lia-unicode-emoji" title=":confused_face:">😕</span></SPAN><SPAN>"</SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class="">http\\\</SPAN><SPAN>" </SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class="">GET\\\</SPAN><SPAN>" </SPAN><SPAN class="">\\\</SPAN><SPAN>"</SPAN><SPAN class=""><SPAN class="">/api/v1/"</SPAN></SPAN></P><P><SPAN class=""><SPAN class="">Trying to remove the extra \ \\ that came with the data via HEC.</SPAN></SPAN></P> Wed, 15 Dec 2021 16:50:19 GMT https://community.splunk.com/t5/Getting-Data-In/Remove-characters-during-search-time-extraction/m-p/578512#M102147 parkertctr 2021-12-15T16:50:19Z