classic xml - token eval using replace function not working

[_guy]

So I've been turning myself inside out trying to figure this one out and cannot...

In search this works fine, 'test' evaluates to "default"

| makeresults
| eval value = "users|default"
| eval test = replace(value, "(\w*)\|(\w*)", "\2")

Trying to make this work as a token eval however is proving difficult. I am trying to do this:
(where <set token="form.chg_focus">users|default</set> is defined elsewhere to trigger a change for the input)

<input type="text" token="chg_focus" depends="$HIDDEN$">
  <change>
    <eval token="nav_chart_mode">replace($value$, "(\w*)\|(\w*)", "\2")</eval>
  </change>
</input>

The above is a simplified version of the input I am trying to implement which involves multiple token sets and evals.

I figured out that I needed to double up the instances of \ in the regex expression , so for example this works (i.e. I get $nav_chart_mode$=default)

<eval token="nav_chart_mode">replace($value$, "\\w*\\|", "")</eval>

So does this 

<eval token="nav_chart_mode">replace($value$, "\\w*\\|\\w*", "default")</eval>

However I cannot seem to get this to work - all I get is $nav_chart_mode$="" (i.e. blank string). 

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "\2")</eval>

Using "\\2" results in $nav_chart_mode$=\2, so that isn't the answer.

I also tried using \( and \), i.e. "\(\\w*\)\\|\(\\w*\)", and no joy there - also results in $nav_chart_mode$="".

I also tried using double (( and )), also not helpful... (and not logical, but I was getting desperate 😊)

I am hoping someone out there can help me understand what I am not understanding...

Cheers

[richgalloway]

You tried doubling the escape characters in the pattern, but did you try it in the replacement?

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "\\2")</eval>

[_guy]

Thanks for the suggestion richgalloway, but yes, I tried that and it resulted in this

nav_chart_mode="\2"

[ITWhisperer · Accepted solution]

Different flavours of regex use different ways to reference captured values - it looks like Splunk may be using different flavours between SPL and token evals. Try this

<eval token="nav_chart_mode">replace($value$, "(\\w*)\\|(\\w*)", "$2")</eval>

[_guy]

Awesome, thank you! I felt it had to be possible with the right tweak, and you nailed it 🙏