https://community.splunk.com/t5/Splunk-Search/How-to-manually-save-a-saved-search-which-contains-backslashes/m-p/631435#M219311 <P>I've seen lots of backslashes in savedsearches.conf.&nbsp; The only special use for them is as a line continuation character and that's only when <FONT face="courier new,courier">\</FONT> is the last character on a line.&nbsp; Have you <STRONG>tried</STRONG> putting that query in the config file?</P> Sat, 18 Feb 2023 13:23:55 GMT richgalloway 2023-02-18T13:23:55Z https://community.splunk.com/t5/Splunk-Search/How-to-manually-save-a-saved-search-which-contains-backslashes/m-p/631354#M219282 <P>I have a splunk query as below which contains a lot of backslashes</P><LI-CODE lang="markup"> index="ABC" os="Win" FileName="*\\Programs\\Startup\\*" | rex field=FileName "Users\\\(?&lt;username&gt;[^\\\]+)." </LI-CODE><P>Now, I now that when I tried to add this in savedseacrhes.conf it wont work as expected as in Splunk it breaks the line when it sees backslash.&nbsp;</P><P>&nbsp;</P><P>Any suggestion on how we can add it to saved searches.conf&nbsp; ?</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup"></LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 17 Feb 2023 16:11:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-manually-save-a-saved-search-which-contains-backslashes/m-p/631354#M219282 pavanae 2023-02-17T16:11:05Z https://community.splunk.com/t5/Splunk-Search/How-to-manually-save-a-saved-search-which-contains-backslashes/m-p/631435#M219311 <P>I've seen lots of backslashes in savedsearches.conf.&nbsp; The only special use for them is as a line continuation character and that's only when <FONT face="courier new,courier">\</FONT> is the last character on a line.&nbsp; Have you <STRONG>tried</STRONG> putting that query in the config file?</P> Sat, 18 Feb 2023 13:23:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-manually-save-a-saved-search-which-contains-backslashes/m-p/631435#M219311 richgalloway 2023-02-18T13:23:55Z