topic Re: Backslashes being doubled in Splunk Search

Backslashes being doubled

Ayn — Fri, 05 Aug 2011 09:30:59 GMT

Whenever a backslash is used in questions/answers/comments on splunk-base, another backslash will be added.

For instance, the following regex snippet is entered with single backslashes only, but splunk-base adds another backslash to each.

rex "(?<foo>\d+)\S+"

In regular text this doesn't seem to happen: rex "(?\d+)\S+"

But in text formatted using backticks it does: rex "(?<foo>\d+)\S+"

This is causing confusion for people sharing regular expressions etc. Are splunk-base administrators aware of this issue and working on a way to resolve it?

Re: Backslashes being doubled

gkanapathy — Fri, 05 Aug 2011 10:34:44 GMT

Even worse, the "preview" while you are editing it shows it correctly, i.e., without the extra characters.

Re: Backslashes being doubled

oprokhorenko_sp — Tue, 27 Mar 2012 18:34:14 GMT

Thank you for heads up. This problem has been fixed on 19 Aug '11.

Please do not hesitate to contact us if you have any problems or suggestions.