Dashboards & Visualizations

Can you help me with "\\" in a dropdown?

atyshke1
Path Finder

Hello Dear Team,

I'm having some trouble. I created a dropdown menu and this menu fulling from search:

index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name

The search is ok.

When I select from the dropdown menu account with a name that doesn't contain "\" (for example account name: $first0ne), the search works fine. But when I try to select an account with a domain name like FOEU\$ahhfty, the search doesn't work.

I understand that the reason why the search doesn't work is because the dropdown was put into search row "server_principal_name:$server_principal_name$" value with one "\" but needed to be inserted in search with two symbols "\":

source="WinEventLog:App*" index="wineventlog" host="*" server_principal_name:$server_principal_name$ | bin _time span=1d | rex "\s+server_principal_name:(?<server_principal_name>.*)" | rex "statement:(?<statement>.*)" | rex "target_server_principal_name:(?<target_server_principal_name>.*)" | rex "event_time:(?<Event_time>\S+\s\w+:\w+:\w+)" | rename host as Host statement as Statement, server_principal_name as Account, target_server_principal_name as "Target Account" Event_time as "Event Time" | stats sparkline as "Magnitude Trend" count as Count by Host, Statement, Account, "Target Account", "Event Time" 

How can I add an additional "\" into the search code that has a value for search like "FOEU\$ahhfty" ?

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

You can use this

replace "\\" with "\\\\" in $server_principal_name$

View solution in original post

0 Karma

atyshke1
Path Finder

How can I use replace in code? I didn't get you.
This search code:
index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name
finding and filling dropdown. When I select from this dropdown menu it automatically inserted in search and looks.

0 Karma

Vijeta
Influencer
index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name 
|replace "\\" with "\\\\" in server_principal_name
0 Karma

Vijeta
Influencer

You can use this

replace "\\" with "\\\\" in $server_principal_name$
0 Karma

atyshke1
Path Finder

Got it. Thank you very much for gave me right way :slightly_smiling_face:
I just need use this one:

index="wineventlog" | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name | replace "*\\*" with "*\\\\*" in server_principal_name

0 Karma

atyshke1
Path Finder

I tried in search this one:
index="wineventlog" | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name | replace "\\" with "\\\\" in server_principal_name
But it doesn't replace one symbol "\" on two "\"

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...