topic Re: Regex in Splunk Search

What regex to use to remove \\ form the hostname fields?

SabariRajanT — Sun, 27 Nov 2022 16:11:43 GMT

Hi All,

I have a hostname stating \\sent134

I need to remove this \\ using regex and it should be like this: sent134

Actual:

\\sent134

Expected should be:

sent134

===

Please provide regex to remove \\ form the hostname fields.

Thanks

isoutamo — Fri, 25 Nov 2022 09:37:45 GMT

| makeresults | eval foo="\\\\sent134" | fields - _time ```above generates testdata like "\\sent134" ``` | rex mode=sed field=foo "s/\\\//g"

previous should work. If needed add/remove \-characters (as usually 😉

r. Ismo

SabariRajanT — Fri, 25 Nov 2022 10:19:53 GMT