for example : C:\user\process --> C:\\user\\process
In Eval, We can use string format function (replace) to replace "\" by two "\\".
Here, We need to escape "\" two times,
One of the way to replace it,
props.conf
EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")
in Search Query:
| eval new_path = replace(path ,"(\\\\)","\\\\\1")
In Eval, We can use string format function (replace) to replace "\" by two "\\".
Here, We need to escape "\" two times,
One of the way to replace it,
props.conf
EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")
in Search Query:
| eval new_path = replace(path ,"(\\\\)","\\\\\1")
why 4 backslashes?