topic Re: Help with basic regex in Splunk Search

Help with basic regex

jip31 — Fri, 21 Jul 2023 07:56:00 GMT

Is anybody can tell me what is the goal of this regex?

| regex ImagePath="\\\\\\\\"

As far as I know, it seems to search a character chain delimited by 4 backslash?

Thanks

Re: Help with basic regex

gcusello — Fri, 21 Jul 2023 07:59:27 GMT

Hi @jip31,

we could better help you if you share a sample of your logs.

Anyway, 4 back slashes are often required wen in you logs you have a back slash that must be escaped to avoid that SPL interpretes it a control char.

Ciao.

Giuseppe

Re: Help with basic regex

ITWhisperer — Fri, 21 Jul 2023 09:18:23 GMT

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

Re: Help with basic regex

isoutamo — Fri, 21 Jul 2023 09:29:15 GMT

here is @xpac 's excellent post about escaping \ on splunk https://community.splunk.com/t5/Splunk-Enterprise/How-many-escapes-quot-quot-do-I-need-in-conf-file-regex/m-p/646714#M16568

r. Ismo

Re: Help with basic regex

gcusello — Sat, 22 Jul 2023 06:00:22 GMT

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉