topic Re: How do you use regex to escape a backslash? in Splunk Search

How do you use regex to escape a backslash?

jacqu3sy — Wed, 13 Feb 2019 15:30:32 GMT

Hi,

I have the following regex which works on regex101, but gives me an error when I try and use this within a Splunk query. Not sure if it's the fact that Im trying to escape the backslash that's causing the issue.

I have the field;

"UserName\a123456"

And I want to extract this into a field called NewUserName where it equals everything after the \ and up to closing quotes. So

NewUserName should be;

a123456

As I said, it works on Regex101 with the following;

"ADMIN\\*(?P[^"]*)"

But when I try it in Splunk via;

| rex field=_raw "ADMIN\\*(?P[^"]*)"

I get the error;

Mismatched ']'

Any ideas?

Re: How do you use regex to escape a backslash?

vnravikumar — Wed, 13 Feb 2019 15:38:50 GMT

Hi @jacqu3sy

Try this

| makeresults 
   | eval msg="UserName\a123456" | rex field=msg "\\\(?P<NewUserName>.*)"

Re: How do you use regex to escape a backslash?

jacqu3sy — Wed, 13 Feb 2019 15:53:15 GMT

Thanks. That worked. Not sure why it needs 3 backslashes though?! Think thats what caught me out. And could you explain what the P after the ? is for?

Thanks.

Re: How do you use regex to escape a backslash?

mydog8it — Wed, 13 Feb 2019 15:58:55 GMT

I don't see your regex working in regex101 with the sample provided. This regex matches your sample in regex101...
UserName\(?P[^"]*)

so perhaps this would work in Splunk...
rex field=_raw "UserName\(?P[^"]*)"

Re: How do you use regex to escape a backslash?

vnravikumar — Wed, 13 Feb 2019 16:08:23 GMT

(?P<>) is a named group which stores the extracted value.

Re: How do you use regex to escape a backslash?

woodcock — Wed, 13 Feb 2019 16:13:06 GMT

The P is not necessary in Splunk's implementation of RegEx, but it is harmless (and distracting). I never use it.

Re: How do you use regex to escape a backslash?

kushagra9120 — Sun, 17 Feb 2019 11:50:59 GMT

I think this should work as it will only pick the string in format "UserName\a123456" and not any string that starts with backslash :-

rex field =_raw "^".\(?P.)\""

Re: How do you use regex to escape a backslash?

Ganesh_Udar — Wed, 01 Jul 2020 06:16:43 GMT

Great , ! Thank you so much.