topic Re: Replace in SPL2 not working like SPL in Splunk Search

Replace in SPL2 not working like SPL

KeithH — Thu, 13 Mar 2025 01:40:05 GMT

Hi,

I am having trouble getting replace to work correctly in Ingest Processor and have this example.

In SPL I can run this search:

| makeresults | eval test = "AAABBBCCC" | eval text = "\\\"test\\\":\\\"" | eval output = replace(test, "BBB", text)

and I will get this output

But if I run this in a Ingest Processor pipeline

| eval test = "AAABBBCCC"
| eval text = "\\\"test\\\":\\\""
| eval output = replace(test, "BBB", text)

The result is:

Note the slashes before the doublequotes have gone.

Why have they gone?

How do I ensure they are retained by Ingest Processor.

This is a simplified example of what I am trying to do but this is the core of the problem I am having.

Thanks

Re: Replace in SPL2 not working like SPL

KeithH — Thu, 13 Mar 2025 01:42:37 GMT

Oh for some reason the image of the SPL2 result didnt post so here it is:

Re: Replace in SPL2 not working like SPL

bowesmana — Thu, 13 Mar 2025 03:47:55 GMT

Splunk uses PCRE and also the search parser will handle unescaping, whereas Ingest Processor uses RE2 - although that appears to be changing. So you probably need to use 2 \\ characters, not 3 as the Splunk parser will take away one.

But validate

Re: Replace in SPL2 not working like SPL

KeithH — Thu, 13 Mar 2025 04:26:48 GMT

Hi Bowesmana,

I tried that too but the editor wont even let me save it that way:

Also note that while this simple example illustrates the problem the real data is extracted by previous rex command so my ability to manipulate it is limited.
Thanks

Re: Replace in SPL2 not working like SPL

bowesmana — Thu, 13 Mar 2025 22:38:32 GMT

Mmm, OK, I was going to suggest the SPL2 channel in the Splunk Slack group, but I see you already found that.

Re: Replace in SPL2 not working like SPL

KeithH — Mon, 17 Mar 2025 00:30:02 GMT

UPDATE: I pursued this via another angle and have had agreement from Splunk that this seems to be a bug and that they will put some work into it though I dont have any reference number or ETA as yet.

In the meantime I am use the rex command with mode=sed to achieve something acceptable but not as good as I would have liked.

Re: Replace in SPL2 not working like SPL

KeithH — Thu, 20 Mar 2025 00:59:50 GMT

Further Update: Splunk fixed the bug and expect it to be released to Splunk Cloud in the next couple of weeks.