topic Re: How to add an escape \ to a value? in Splunk Search

How to add an escape \ to a value?

ccsfdave — Fri, 10 Jun 2016 15:03:14 GMT

Greetings,

I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username. I would like to use the results as a token in the next panel, but in order to do that I need it to be in the form of "Domain\\username". Does anyone have a pointer on how I may accomplish this?

Thanks

Re: How to add an escape \ to a value?

cmccririe — Fri, 10 Jun 2016 23:41:17 GMT

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra .

|rex field=usernames ""(?[^\]+)\(?.*)"
|eval username = domain . "\\" . user
|stats count by username

This will give you values of the username field with the additional backslash for your escape character.

Re: How to add an escape \ to a value?

woodcock — Mon, 13 Jun 2016 17:38:55 GMT

Like this:

... | rex field=username mode=sed "s/\\\/\\\\\\\/"

Re: How to add an escape \ to a value?

ccsfdave — Mon, 13 Jun 2016 17:41:43 GMT

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"