topic replace one backslash by double backslash in Splunk Search

replace one backslash by double backslash

ryastrebov — Mon, 22 Apr 2013 09:01:49 GMT

Hello!
I need to provide search only in earliest source in my sourcetype.
I use this search request for this purposes:
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
But I get error "No results found".
I found that the firstsource of returns in the form of D:\MyFolder\Mysourcename.gz while for a successful search must have a value as D:\\MyFolder\\Mysourcename.gz
How can I replace \ to \\?

Re: replace one backslash by double backslash

kristian_kolb — Mon, 22 Apr 2013 09:10:37 GMT

sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.

UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

Re: replace one backslash by double backslash

ryastrebov — Mon, 22 Apr 2013 09:37:48 GMT

I get error "Error in 'rex' command: Failed to initialize sed. Failed to parse the regex to replace."

Re: replace one backslash by double backslash

cphair — Wed, 14 Jun 2017 16:50:46 GMT

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work:

rex mode=sed field=foo "s/(\\\)/\1\1/g"

Re: replace one backslash by double backslash

splunkreal — Fri, 22 Mar 2019 15:32:03 GMT

Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂

Re: replace one backslash by double backslash

splunkreal — Mon, 25 Mar 2019 10:03:01 GMT

SOLVED : needed to escape again : "s/(\\\\\)/\1\1/g"

Re: replace one backslash by double backslash

manan_amin — Wed, 22 Jul 2020 18:00:22 GMT

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")