Can you help me with "\\" in a dropdown?

[atyshke1]

Hello Dear Team,

I'm having some trouble. I created a dropdown menu and this menu fulling from search:

index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name

The search is ok.

When I select from the dropdown menu account with a name that doesn't contain "\" (for example account name: $first0ne), the search works fine. But when I try to select an account with a domain name like FOEU\$ahhfty, the search doesn't work.

I understand that the reason why the search doesn't work is because the dropdown was put into search row "server_principal_name:$server_principal_name$" value with one "\" but needed to be inserted in search with two symbols "\":

source="WinEventLog:App*" index="wineventlog" host="*" server_principal_name:$server_principal_name$ | bin _time span=1d | rex "\s+server_principal_name:(?<server_principal_name>.*)" | rex "statement:(?<statement>.*)" | rex "target_server_principal_name:(?<target_server_principal_name>.*)" | rex "event_time:(?<Event_time>\S+\s\w+:\w+:\w+)" | rename host as Host statement as Statement, server_principal_name as Account, target_server_principal_name as "Target Account" Event_time as "Event Time" | stats sparkline as "Magnitude Trend" count as Count by Host, Statement, Account, "Target Account", "Event Time" 

How can I add an additional "\" into the search code that has a value for search like "FOEU\$ahhfty" ?

[atyshke1]

How can I use replace in code? I didn't get you.
This search code:
index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name
finding and filling dropdown. When I select from this dropdown menu it automatically inserted in search and looks.

[Vijeta]

index="wineventlog" host=$EventHost$ | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name 
|replace "\\" with "\\\\" in server_principal_name

[Vijeta · Accepted solution]

You can use this

replace "\\" with "\\\\" in $server_principal_name$

[atyshke1]

Got it. Thank you very much for gave me right way 🙂
I just need use this one:

index="wineventlog" | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name | replace "*\\*" with "*\\\\*" in server_principal_name

[atyshke1]

I tried in search this one:
index="wineventlog" | rex "\s+server_principal_name:(?<server_principal_name>.*)" | stats count by server_principal_name | replace "\\" with "\\\\" in server_principal_name
But it doesn't replace one symbol "\" on two "\"