topic Tricky behavior of escaping backslash in regex in Splunk Search

Tricky behavior of escaping backslash in regex

ypeng_splunk — Wed, 07 Mar 2018 11:45:48 GMT

Hey folks,

I am doing some regex stuff by rex command and find some tricky behavior.

Error: I tried to use \ to escape the backslash in three places. Not sure which one doesn't work.

But, this regex works on regex101.

OK, let's try some other ways in the search to make it accepted by my Splunk as below:

This time, it works perfectly. Here is the confusing point. Why does "\" work at the beginning, but doesn't work for the second and third backslash.
\x5c can be a good replacement. But, why "\\" works to escape single \?

Any idea is appreciated.

Re: Tricky behavior of escaping backslash in regex

FrankVl — Wed, 07 Mar 2018 15:08:30 GMT

As far as I'm aware, there is some double escaping going on, first from the search bar to the regex and then of course inside the regex.

To match a single \ in a string
you need \\ in your regex, to achieve that, you need \\\\ in the splunk search bar in the rex command.

The reason your second attempt seems to work is that you do not require splunk to match the full string from the start, so Splunk is not matching both backslashes at the start of the path, but ignores the first and then starts the match from the second backslash.

But I do agree that is a bit tricky and confusing, also because it doesn't seem to correspond to what is in documentation: http://docs.splunk.com/Documentation/Splunk/7.0.1/Search/SPLandregularexpressions

Also somehow your eval requires 4 backslashes to make the field start with 2 backslashes but no additional backslashes for the backslashes in the middle of your string...

PS: the code segment parser here on splunk answers also seems to struggle a bit with such backslash characters 😛

Re: Tricky behavior of escaping backslash in regex

ifeldshteyn — Thu, 24 May 2018 18:43:12 GMT

Thanks, I didn't realize I had to put in 4 backslashes for one.