All Apps and Add-ons

Workaround for backslashes in values as noted in CSCvc36977

davebo1896
Communicator

I created a transform to get rid of the backslashes in the values as mentioned in this bugreport:
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc36977

Thought I'd throw it out here in case anyone needs it:

MV_ADD = 1
REGEX = (,\s|\\,)?(?<_KEY_1>[A-Za-z\-\s]+)=(?<_VAL_1>([^(,\s|\\,)]|\s)*)(,\s|\\,)?
0 Karma

davebo1896
Communicator

Improved:
MV_ADD = 1
REGEX = (,\s|\,)?((?<_KEY_1>[A-Za-z-\s\d]+)=(?<_VAL_1>[^,]+(?!\,)))(,\s|\,)?

But still not complete

0 Karma

ChrisBell04
Communicator

I took a different approach and removed the slashes instead. ISE 2.2.0.x still has this problem (bug linked to only 1.4.x)

[cisco:ise:syslog]
SEDCMD-strip_slash = s/\\\,/, /g
SEDCMD-strip_semicln = s/\\\;/;/g
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...