topic Using a literal pipe "|" character in an extracted regex field in Splunk Search

Using a literal pipe "|" character in an extracted regex field

jbrenner — Thu, 14 Jun 2018 18:17:53 GMT

I'm creating an extracted field using a regex, and I want to use a literal pipe "|" character in the regex.
My understanding is to use a backspace as an escape character as follows:

\|

When I save the regex and return to it, however, the backslash has been removed.
What am I doing wrong?

Thanks,
Jonathan

Re: Using a literal pipe "|" character in an extracted regex field

jbrenner — Thu, 14 Jun 2018 18:19:55 GMT

Sorry. meant to say "backslash," not "backspace" 🙂

Re: Using a literal pipe "|" character in an extracted regex field

somesoni2 — Thu, 14 Jun 2018 19:34:58 GMT

What's the full regex that you're using? How are you saving it, using IFX (interactive field extraction wizard) OR directory through settings?

Re: Using a literal pipe "|" character in an extracted regex field

jbrenner — Thu, 14 Jun 2018 19:55:29 GMT

Hi,

I don't know what I was doing wrong, but after trying some different things, it stopped stripping out the escape characters.
I think I must have doing something wrong in the UI.
To answer your question, though, I was selecting the dropdown that says "Event Actions" and selecting "Extract Fields"

Thanks for responding,
Jonathan

Re: Using a literal pipe "|" character in an extracted regex field

somesoni2 — Thu, 14 Jun 2018 20:31:33 GMT

Glad your issue is resolved. If there are no other followup (related) questions, they you can close this question by accepting this as an answer.