https://community.splunk.com/t5/Splunk-Enterprise-Security/Drill-down-with-process-path/m-p/464166#M6842 <P>Hi all,</P> <P>I am having major issues with creating drilldown to correlation searches, using tokens of the process paths. </P> <P>The problem is that splunk doesn't know how to refer to the "\".</P> <P>I have tried to modify the token and replace every "\" with "\", but with no luck.</P> <P>Does anyone knows how to workaround this issue ? </P> <P>Example for drilldown: </P> <P>| from datamodel:Endpoint.Processes<BR /> | search process_path = $process_path $ AND dest=$dest$</P> <P>** $process_path$="C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe"</P> <P>Thanks in advance ! </P> Wed, 30 Sep 2020 04:04:30 GMT astatrial 2020-09-30T04:04:30Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Drill-down-with-process-path/m-p/464166#M6842 <P>Hi all,</P> <P>I am having major issues with creating drilldown to correlation searches, using tokens of the process paths. </P> <P>The problem is that splunk doesn't know how to refer to the "\".</P> <P>I have tried to modify the token and replace every "\" with "\", but with no luck.</P> <P>Does anyone knows how to workaround this issue ? </P> <P>Example for drilldown: </P> <P>| from datamodel:Endpoint.Processes<BR /> | search process_path = $process_path $ AND dest=$dest$</P> <P>** $process_path$="C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe"</P> <P>Thanks in advance ! </P> Wed, 30 Sep 2020 04:04:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Drill-down-with-process-path/m-p/464166#M6842 astatrial 2020-09-30T04:04:30Z