https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704323#M238674 <P>I did an inputlookup to get my field (uploads) and used this piece of search I found on another post:</P> <LI-CODE lang="markup">| fields uploads | rex field=uploads mode=sed "s/(\d+)/%\1/g" | eval decode=urldecode(uploads)</LI-CODE> <P>I think I'm very close, but my decoded string has a space between every character looking something like this:</P> <P>\ \ \ \ * \ \ b r a n c h \ \ s y s t e m \ \ t y p e 1 \ \ *</P> <P>&nbsp;</P> Wed, 13 Nov 2024 19:57:00 GMT DaClyde 2024-11-13T19:57:00Z https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704199#M238639 <P>I am attempting to use a lookup to feed some UNC file paths into a dashboard search, but I am getting tripped by all the escaping of the backslashes and double quites in my string.</P><P>I want to call a field from a lookup with something like this as the actual value:</P><P>file_path="\\\\*\\branch\\system\\type1\\*" OR file_path="\\\\*\\branch\\system\\type2\\*"</P><P>I want to populate a field in my lookup table with actual key/value pairs and output the entire string based on a menu selection.&nbsp; Unfortunately, if I try this, Splunk escapes all the double quotes and all the backslashes and it ends up looking like this in the litsearch, which is basically useless:</P><P><SPAN>file_path=\"\\\\\\\\*\\\\branch\\\\service\\\\type1\\\\*\" OR file_path=\"\\\\\\\\*\\\\branch\\\\service\\\\type2\\\\*\"<BR /><BR />How can I either properly escape the value within the lookup table so this doesn't happen, or is there any way to get Splunk to output the lookup value as a literal string and not try to interpret it?</SPAN></P> Tue, 12 Nov 2024 17:05:12 GMT https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704199#M238639 DaClyde 2024-11-12T17:05:12Z https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704289#M238665 <P>Try using tokens set to the ASCII hex value.&nbsp; When written the token gets replaced by the single character.</P> Wed, 13 Nov 2024 14:32:40 GMT https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704289#M238665 dural_yyz 2024-11-13T14:32:40Z https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704323#M238674 <P>I did an inputlookup to get my field (uploads) and used this piece of search I found on another post:</P> <LI-CODE lang="markup">| fields uploads | rex field=uploads mode=sed "s/(\d+)/%\1/g" | eval decode=urldecode(uploads)</LI-CODE> <P>I think I'm very close, but my decoded string has a space between every character looking something like this:</P> <P>\ \ \ \ * \ \ b r a n c h \ \ s y s t e m \ \ t y p e 1 \ \ *</P> <P>&nbsp;</P> Wed, 13 Nov 2024 19:57:00 GMT https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704323#M238674 DaClyde 2024-11-13T19:57:00Z https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704344#M238678 <P>A second layer of sed script successfully strips the excess whitespace, but it doesn't look like I can include a double quote, even encoded, without Splunk escaping it in the value.&nbsp; I was really hoping to chain several OR statements into a single lookup value, but I guess that isn't possible.</P> Wed, 13 Nov 2024 20:45:36 GMT https://community.splunk.com/t5/Splunk-Search/Possible-to-output-a-literal-string-with-backslashes-from-a/m-p/704344#M238678 DaClyde 2024-11-13T20:45:36Z