Hi people I'm having some issues in a chart drill down that has Windows paths (like: C:\Users\Administrator). When I click in the windows paths to drill down it passes to the next dashboard the variable of the windows path (C:\Users\Administrator) and the search of the next dashboard cannot find any data since splunk search must double back slash to search properly.
If I do a search like: "sourcetype=src1 path="C:\Users\Administrator"" I cannot find any results, but If I search using this: "sourcetype=src1 path:"C:\\Users\\Administrator"" I can find the results. Is there any automatic way to transforms this single back slash into two back slashes (\\) maybe using eval.
Here are some data that may help you understand better:
date=10:16:08.000 AM 2/7/2014 10:16:08 path="C:\Users\Administrator" file=file.exe risk=High
date=10:12:33.000 AM 2/7/2014 05:39:28 path="C:\Users\Administrator" file=blocker.exe risk=High