https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262699#M50422 <P>| eval RelativeTargetNameSplit = split("aaaaaXbbbb", "X") just worked for me with double quotes and not single ones around the X.</P> Mon, 28 Mar 2016 21:46:28 GMT ddrillic 2016-03-28T21:46:28Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262697#M50420 <P>Anyone else having trouble or have guidance to split fields backslashes such as with file paths?</P> <P>The field value is displayed as: </P> <PRE><CODE>folder1\folder2\file.txt </CODE></PRE> <P>And the raw value is:</P> <PRE><CODE>folder1\\folder2\\file.txt </CODE></PRE> <P>I have tried this with no luck:</P> <PRE><CODE>| eval RelativeTargetNameSplit = split(RelativeTargetName, '\') | eval RelativeTargetNameSplit = split(RelativeTargetName, '\\') | eval RelativeTargetNameSplit = split(RelativeTargetName, '\\\\') </CODE></PRE> Mon, 28 Mar 2016 15:35:08 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262697#M50420 ajlBXsplunk 2016-03-28T15:35:08Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262698#M50421 <P>Your example data has backslashes, your attempts have forward slashes.</P> Mon, 28 Mar 2016 16:50:42 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262698#M50421 martin_mueller 2016-03-28T16:50:42Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262699#M50422 <P>| eval RelativeTargetNameSplit = split("aaaaaXbbbb", "X") just worked for me with double quotes and not single ones around the X.</P> Mon, 28 Mar 2016 21:46:28 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262699#M50422 ddrillic 2016-03-28T21:46:28Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262700#M50423 <P>| eval RelativeTargetNameSplit = split("folder1\folder2\file.txt", "\") worked as well.</P> Mon, 28 Mar 2016 21:51:38 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262700#M50423 ddrillic 2016-03-28T21:51:38Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262701#M50424 <P>Oops, updated to include the right slashed. Thanks for pointing that out.</P> Mon, 28 Mar 2016 22:00:11 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262701#M50424 ajlBXsplunk 2016-03-28T22:00:11Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262702#M50425 <P>| eval RelativeTargetNameSplit = split("folder1\folder2\file.txt", "\") does work for me but not with the input is from a field (as opposed to an explicit string)</P> Mon, 28 Mar 2016 22:12:01 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262702#M50425 ajlBXsplunk 2016-03-28T22:12:01Z https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262703#M50426 <P>You're right, When dealing with slashes, use quotes (").</P> <PRE><CODE>| eval RelativeTargetNameSplit = split(RelativeTargetName, "\\") </CODE></PRE> Mon, 28 Mar 2016 22:16:10 GMT https://community.splunk.com/t5/Getting-Data-In/Splitting-fields-with-slashes/m-p/262703#M50426 ajlBXsplunk 2016-03-28T22:16:10Z