https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595794#M207371 <P>Have you even tried it?</P><P>Due to the way splunk escapes backslash in regex expressions, you need 4 backslashes to match a single backslash in the field, therefore 8 backslashes (as I have used), will find anything more than 1 in the field.</P><LI-CODE lang="markup">| makeresults | eval _raw="cmd.exe c:\\windows\\\\\\\\\\\\\\\\sytem32\\[...] cmd.exe c:\\\\windows\\\\sytem32\\\\[...] cmd.exe c:\\windows\\sytem32\\[...]" | multikv noheader=t | regex _raw="\\\\\\\\"</LI-CODE> Thu, 28 Apr 2022 14:29:54 GMT ITWhisperer 2022-04-28T14:29:54Z https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595789#M207368 <P>Hi, is there a way to search for more than one appearance of a pattern in a string?<BR /><BR />For example:<BR />Command<BR />cmd.exe <SPAN>c:\windows\\\\\\\\sytem32\[...]<BR />cmd.exe c:\windows\sytem32\[...]<BR /><BR />I would want to search for rows with more than single consecutive "\" , in case of above only first row to be returned.<BR /></SPAN></P> Thu, 28 Apr 2022 13:50:48 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595789#M207368 KMoryson 2022-04-28T13:50:48Z https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595790#M207369 <LI-CODE lang="markup">| regex _raw="\\\\\\\\"</LI-CODE> Thu, 28 Apr 2022 13:57:07 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595790#M207369 ITWhisperer 2022-04-28T13:57:07Z https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595791#M207370 <P>This only matches to this specific amount of backslashes, I want to match for any number above one</P> Thu, 28 Apr 2022 14:04:45 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595791#M207370 KMoryson 2022-04-28T14:04:45Z https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595794#M207371 <P>Have you even tried it?</P><P>Due to the way splunk escapes backslash in regex expressions, you need 4 backslashes to match a single backslash in the field, therefore 8 backslashes (as I have used), will find anything more than 1 in the field.</P><LI-CODE lang="markup">| makeresults | eval _raw="cmd.exe c:\\windows\\\\\\\\\\\\\\\\sytem32\\[...] cmd.exe c:\\\\windows\\\\sytem32\\\\[...] cmd.exe c:\\windows\\sytem32\\[...]" | multikv noheader=t | regex _raw="\\\\\\\\"</LI-CODE> Thu, 28 Apr 2022 14:29:54 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595794#M207371 ITWhisperer 2022-04-28T14:29:54Z https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595795#M207372 <P>So sorry, you are right, this works wonderfully, thank you for help</P> Thu, 28 Apr 2022 14:36:40 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-multiple-apperances-of-a-pattern-in-a-field/m-p/595795#M207372 KMoryson 2022-04-28T14:36:40Z