topic Why when I use "\\" it shows results with only one "\" in Splunk Search

Why when I use "\\" it shows results with only one "\"

rasamur — Thu, 20 Jul 2017 20:41:50 GMT

I'm currently creating a search and in my search I entered the following

source="FileName.csv" \ OR SMS

In the results it shows events with a Single "\" and double "\". I need to show results with two "\" not only one.

I've tried:

\
"\"
punct=*\*

But still it shows only results with only one "\". What can be done so the results show results where there is actually two "\"?

Regards

sbbadri — Thu, 20 Jul 2017 20:44:55 GMT

use "\" for single slash and use "\\" for double slash. Because splunk use slash as an escape character.

woodcock — Thu, 20 Jul 2017 21:10:52 GMT

Use \\.

rasamur — Thu, 20 Jul 2017 21:29:57 GMT

Thank you for the help.