topic Re: Replacing single backslash with double backslash and searching the result in Splunk Search

Replacing single backslash with double backslash and searching the result

ganesanvc — Fri, 18 Apr 2025 16:55:58 GMT

Hi all,

I'm trying to dynamically replace single backslashes with double backslashes in a search string and use the result to search across a field (e.g., FileSource). Here's what I’ve tried:

| eval text_search="*\\Test\abc\test\abc\xxx\OUT\*"
| eval text_search_escaped=replace(text_search, "\\\\", "\\\\\\\\")
| search FileSource=text_search_escaped

The output of text_search_escaped looks correct (with double backslashes), and if I run a manual search like below, I do get results:

index=... FileSource="*\\Test\\abc\\test\\abc\\xxx\\OUT\\*"

However, when I try to use the text_search_escaped variable inside search, I get no results.

Am I missing something in how Splunk treats dynamic fields inside search? Is there a better way to pass an escaped Windows-style path to a search clause?

Re: Replacing single backslash with double backslash and searching the result

yuanliu — Sat, 19 Apr 2025 05:43:33 GMT

However, when I try to use the text_search_escaped variable inside search, I get no results.

Splunk's search command can only use field name like text_search_escaped on the left-hand side. If you want to use a field's value, where is your friend. For example, you can say

| eval text_search="%\\Test\abc\test\abc\xxx\OUT\%" | eval text_search_escaped=replace(text_search, "\\\\", "\\\\\\\\") | where FileSource LIKE text_search_escaped

Re: Replacing single backslash with double backslash and searching the result

PickleRick — Sat, 19 Apr 2025 06:49:37 GMT

@yuanliuYou meant RHS, not LHS 🙂

@ganesanvcI hope you're running this snippet on an already relatively filtered event stream. If you want to use it as an initial search because you're getting the text_search parameter from elsewhere (like a token in a dashboard) you might be way better off using a subsearch to create a verbatim search term.

Re: Replacing single backslash with double backslash and searching the result

livehybrid — Sat, 19 Apr 2025 15:13:34 GMT

Hi @ganesanvc

Does "text_search" come from a search result - or is this something like a token you are passing in? I couldnt tell from the request but if its coming from a token and you want to apply the additional escaping then you can do this:

index=main source="answersDemo" [| makeresults | eval text_search="*\\Test\abc\test\abc\xxx\OUT\*" | eval FileSource=replace(text_search, "\\\\", "\\\\\\\\") | return FileSource ]

Note: I used a sample event in index=main as you can see in the results above using;

| windbag | head 1 | eval _raw="Test Event for SplunkAnswers user=Demo FileSource=\"MyFileSystem\\Test\\abc\\test\\abc\\xxx\\OUT\\test.exe\" fileType=exe" | eval source="answersDemo" | collect index=main output_format=hec

I may have got the wrong end of the stick with what you're looking for here but let me know!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Replacing single backslash with double backslash and searching the result

ganesanvc — Mon, 21 Apr 2025 18:03:13 GMT

@livehybrid
The screenshot is working fine. but if i implement the same for multiple i am not getting result. do i miss anything in below

[| makeresults
| eval text_search="*$text_search$*"
| eval escaped=replace(text_search, "\\", "\\\\")
| eval FileSource=escaped, RemoteHost=escaped, LocalPath=escaped, RemotePath=escaped
| return FileSource RemoteHost LocalPath RemotePath
]

Re: Replacing single backslash with double backslash and searching the result

ganesanvc — Mon, 21 Apr 2025 12:33:01 GMT

Thanks for your response. I’ve already attempted this, but it didn’t work as expected

Re: Replacing single backslash with double backslash and searching the result

livehybrid — Mon, 21 Apr 2025 15:22:24 GMT

Hi @ganesanvc

Were you able to try the below?

@livehybrid wrote:
Hi @ganesanvc
Does "text_search" come from a search result - or is this something like a token you are passing in? I couldnt tell from the request but if its coming from a token and you want to apply the additional escaping then you can do this:

index=main source="answersDemo" [| makeresults | eval text_search="*\\Test\abc\test\abc\xxx\OUT\*" | eval FileSource=replace(text_search, "\\\\", "\\\\\\\\") | return FileSource ]

Note: I used a sample event in index=main as you can see in the results above using;

I may have got the wrong end of the stick with what you're looking for here but let me know!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Replacing single backslash with double backslash and searching the result

livehybrid — Mon, 21 Apr 2025 20:56:36 GMT

Hi @ganesanvc

If you do "| return FileSource RemoteHost LocalPath RemotePath" then its going to do an AND statement between these fields in your main search - is this what you want?

If you want an "OR" then I think you might want to do:

This will create something like:

( ( FileSource="\\\\Test\\\\abc\\\\test\\\\abc\\\\xxx\\\\OUT\\\\" OR LocalPath="\\\\Test\\\\abc\\\\test\\\\abc\\\\xxx\\\\OUT\\\\" OR RemoteHost="\\\\Test\\\\abc\\\\test\\\\abc\\\\xxx\\\\OUT\\\\" OR RemotePath="\\\\Test\\\\abc\\\\test\\\\abc\\\\xxx\\\\OUT\\\\" ) )

Note - I am not 100% sure how many \\ you are expecting, but when I ran your makeresults search it failed and I had to escape the the replace as:

| eval escaped=replace(text_search, "\\\\", "\\\\\\\\")

You can run the makeresults on its own and substitute your token to validate the output you get and ensure the search works correctly.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Replacing single backslash with double backslash and searching the result

ganesanvc — Tue, 22 Apr 2025 09:55:41 GMT

@livehybrid i am getting no result or 0 record for this

Re: Replacing single backslash with double backslash and searching the result

livehybrid — Tue, 22 Apr 2025 10:29:55 GMT

Hi @ganesanvc

Please can you provide the full search you are trying? Did you try it outside the dashboard in the search bar? If there is a problem with the search you should be able to see it clearly there.

Thanks

Re: Replacing single backslash with double backslash and searching the result

ganesanvc — Tue, 22 Apr 2025 14:21:05 GMT

@livehybrid yes i am trying it outside dashboard in search bar i not getting any error or result as well

Re: Replacing single backslash with double backslash and searching the result

livehybrid — Tue, 22 Apr 2025 22:13:22 GMT

Hi @ganesanvc

Looking at the square braces there, it looks like you're running the sub-search part in the SPL search box, try removing the [ and ] so that we can see if that works independetly.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Replacing single backslash with double backslash and searching the result

ganesanvc — Fri, 25 Apr 2025 17:53:00 GMT

@livehybrid if i remove [] its just creating dummy logs with path its not actually searching result. like below

4/23/25
9:36:05.515 AM

04-23-25 09:36:05,515 [3820] DEBUG Common <> - Started thread

FileSource = *\\test\\abc\\test\\xyz\\abc\\123\\ITEM\\*
eventtype = exclude_known_allowed
host = test
index = test
linecount = 1