topic Re: Removing Backslash in Getting Data In

Removing Backslash

vpsmax — Mon, 21 Sep 2020 15:27:31 GMT

Good morning.

Trying to replace a "\" (backslash) from a string. Below is my example ...

# Perform Global Replace for "&dir+c:\ 443"
SEDCMD-replace_backslash_1 = s/\&\w+\+\w\:\\\s443/&dir+c: 443/g

For some reason, the pattern match is not able to detect the backslash. Are there any special considerations when trying to remove a backslash?

Regards,
Max

Re: Removing Backslash

gcusello — Mon, 21 Sep 2020 15:44:15 GMT

Hi @vpsmax,

try this simple regex:

SEDCMD-replace_backslash_1 = s/:\\\/:/g

that you can test in a search like this:

| makeresults | eval my_field="&dir+c:\ 443" | rex field=my_field mode=sed "s/:\\\/:/g"

Ciao.

Giuseppe

Re: Removing Backslash

vpsmax — Mon, 21 Sep 2020 23:45:53 GMT

Thanks. While the search works as expected, the SEDCMD command does not seem to be picking up. The Indexers and the Heavy Forwarder have been restarted. A new set of entries have been added using "oneshot". Any suggestions on how to get the SEDCMD command to work properly?

Re: Removing Backslash

gcusello — Tue, 22 Sep 2020 06:49:44 GMT

Hi @vpsmax,

props.conf and transforms.conf must be on Indexers or on Heavy Forwarders (when present) and to be sure you can put them in both servers (as you did, remember to restart Splunk).

If your regex doesn't run, check if the sourcetype where you inserted the SEDCMD is correct and try another easier regex :

SEDCMD-replace_backslash_1 = s/\\\//g

Ciao.

Giuseppe

Re: Removing Backslash

vpsmax — Thu, 24 Sep 2020 14:34:30 GMT

Hi Giuseppe,

Good morning. Thank you for your guidance on this. Strangely, we tried what you mentioned ...

SEDCMD-replace-backslash_1 = s/\\\//g

But it did not work. The TA which contains the props.conf and the sourcetype definition were installed on both the Indexers and the HF. Instead, we tried the following ...

SEDCMD-replace-backslash_1 = s/(\\\s)/ /g

And for some reason, this worked! I suppose there are some considerations when using SEDCMD.

Regards,
Max

Re: Removing Backslash

gcusello — Thu, 24 Sep 2020 15:09:28 GMT

Hi @vpsmax,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: please accept the answer for the other people of Community and Karma Points are appreciated 😉