topic Re: How to remove \ (backslash) using from URLs rex sed? in Splunk Search

How to remove \ (backslash) using from URLs rex sed?

ccsfdave — Mon, 01 Aug 2016 16:48:39 GMT

I am trying to remove the escaped characters of "\" from the URLs coming in via a Twitter REST feed. Does anyone have the secret sauce for forming a rex field= mode=sed?

Sample URL: http:\/\/pbs.twimg.com\/media\/CoyGo5cUsAEmIZF.jpg

Thanks!

Re: How to remove \ (backslash) using from URLs rex sed?

gabriel_vasseur — Mon, 01 Aug 2016 16:56:42 GMT

This works for me in the search window:

| eval yourfieldname=replace(yourfieldname,"\\\\(.)","\1")

EDIT: a few words of explanation... the string "\\\\(.)" actually corresponds to the regex \\(.) which will match a single backslash followed by any character. The backslash has to be escaped once for the regex and another time to be in a double-quoted string, hence why one becomes four. If you're using the regex in a .conf file, depending how you do it, you don't need to escape it twice. Hope that helps.

NOTE: the advantage of that approach is that if your raw data has an escaped backslash (i.e. two backslashes in a row), it will do the right thing and replace it with one backslash rather than blindly removing all backslashes.

NOTE: this is probably also possible using sed.

Re: How to remove \ (backslash) using from URLs rex sed?

Jeremiah — Mon, 01 Aug 2016 16:59:13 GMT

Try this:

| gentimes start=-1 | eval url="http:\/\/pbs.twimg.com\/media\/CoyGo5cUsAEmIZF.jpg"  | rex mode=sed field=url "s/\\\//g"

You may also need to use the urldecode command for some urls (|eval url=urldecode(url)).

Re: How to remove \ (backslash) using from URLs rex sed?

ccsfdave — Mon, 01 Aug 2016 17:02:44 GMT

This worked as well! two ways to skin this one! thanks!

Re: How to remove \ (backslash) using from URLs rex sed?

ccsfdave — Mon, 01 Aug 2016 17:02:54 GMT

this worked, thanks!

Re: How to remove \ (backslash) using from URLs rex sed?

wolanm1 — Thu, 12 Nov 2020 13:13:42 GMT

Over 4 years later and this post still helped me solve my problem! Thank you!