Dear All,
I am stuck on an always empty result when searching with a form input that contains Backslash "\"
To illustrate the case, I have some Windows Event log records loaded in Splunk, and available values for the field OS_USER are:
Administrator
NT AUTHORITY\SYSTEM
DEV001\Administrator
I have a simple form, with a drop-down box, in which user is supposed to filter records by OS user name.
When I search with * default or Administrator (choice 1) - I do get the results.
When I search with any of the two other choices (containing Backslash) - I receive "No results found. " This is an error because the records are there, for both back-slashed options.
I tried the CDATA and |s$ - to no result.
Browsed the answers - but found nothing.
Can one please advise on this painful Backslash issue ?
Even telling me that it is better to REMOVE the backslash right at the moment of the data ingest and not deal with it at all!
at your disposal for further info
best regards
Altin
ps. my form is Simple XML
