Splunk Enterprise

Why is Colon Character in JS not working?

rkeq0515
Path Finder

I am trying to use a colon ( : ) in my js file; however, I do not see results when I use the colon.  I verified that the command works with the colon when I run it within a Search window.   I also have it working without the colon in the js file.  I just can't seem to use the colon in the js file. 

The following code in my js file does not work.

 

... | search (path IN (\"*:\\windows\\*\")) | stats count

 

 

The following code in my js file works.

 

... | search (path IN (\"*\\windows\\*\")) | stats count

 

 

I tried to escape it like I did the double-quotes, but that did not work.  Is there a way to use the colon in the js file?

 

Thanks 

0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@rkeq0515 - I always try multiple try-and-error when dealing with \ (backward slash).

One of these should work:

... | search path IN (\"*:\\windows\\*\") | stats count
... | search path IN (\"*:\\\windows\\\*\") | stats count
... | search path IN (\"*:\\\\windows\\\\*\") | stats count

(3 or 4 slashes should work)

 

I hope this helps!!!

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@rkeq0515 - I always try multiple try-and-error when dealing with \ (backward slash).

One of these should work:

... | search path IN (\"*:\\windows\\*\") | stats count
... | search path IN (\"*:\\\windows\\\*\") | stats count
... | search path IN (\"*:\\\\windows\\\\*\") | stats count

(3 or 4 slashes should work)

 

I hope this helps!!!

0 Karma

rkeq0515
Path Finder

Thank you!  The 4 back slashes worked.  I was focused on the colon since 2 back slashes were working.  However, I see that it wasn't providing the correct data.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...