Removing Backslash

[vpsmax]

Good morning.

Trying to replace a "\" (backslash) from a string.  Below is my example ...

# Perform Global Replace for "&dir+c:\ 443"
SEDCMD-replace_backslash_1 = s/\&\w+\+\w\:\\\s443/&dir+c: 443/g

For some reason, the pattern match is not able to detect the backslash.  Are there any special considerations when trying to remove a backslash?

Regards,
Max

[gcusello]

Hi @vpsmax,

try this simple regex:

SEDCMD-replace_backslash_1 = s/:\\\/:/g

that you can test in a search like this:

| makeresults 
| eval my_field="&dir+c:\ 443" | rex field=my_field mode=sed "s/:\\\/:/g"

Ciao.

Giuseppe

[vpsmax]

Thanks.  While the search works as expected, the SEDCMD command does not seem to be picking up.  The Indexers and the Heavy Forwarder have been restarted.  A new set of entries have been added using "oneshot".  Any suggestions on how to get the SEDCMD command to work properly?

[gcusello]

Hi @vpsmax,

props.conf and transforms.conf must be on Indexers or on Heavy Forwarders (when present) and to be sure you can put them in both servers (as you did, remember to restart Splunk).

If your regex doesn't run, check if the sourcetype where you inserted the SEDCMD is correct and try another easier regex :

SEDCMD-replace_backslash_1 = s/\\\//g

Ciao.

Giuseppe

[vpsmax · Accepted solution]

Hi Giuseppe,

Good morning. Thank you for your guidance on this. Strangely, we tried what you mentioned ...

SEDCMD-replace-backslash_1 = s/\\\//g

But it did not work. The TA which contains the props.conf and the sourcetype definition were installed on both the Indexers and the HF. Instead, we tried the following ...

SEDCMD-replace-backslash_1 = s/(\\\s)/ /g

And for some reason, this worked! I suppose there are some considerations when using SEDCMD.

Regards,
Max

[gcusello]

Hi @vpsmax,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: please accept the answer for the other people of Community and Karma Points are appreciated 😉