topic Re: how to replace \ with \\ in eval statement in Splunk Search

how to replace \ with \\ in eval statement

reney44 — Wed, 28 Aug 2019 09:02:03 GMT

i expect var1="d:\test\data.csv" but i got

it shows mismatch or missing closing parenthesis

var="d:\test\data.csv" |eval var1=replace(var,"\","\\")

p_gurav — Wed, 28 Aug 2019 09:07:29 GMT

This may help:

javiergn — Wed, 28 Aug 2019 09:13:20 GMT

If all you are trying to do is to replace one backslash with two then you can do the following:

| stats count
| eval var="d:\\test\\data.csv"
| eval var1=replace(var,"\\\\","\\\\\\")

(Ignore the stats count as I used this to test)
Output:

Take a look at the following links if you want to read more about it:

Regards,
J