Backslash character on subsearch result

[joshiro]

Hi, i am currently working in a search to filter values based on a lookup table and i am having a difficult time with the backslash character ("\").
The search is the following:

index=<index> source=source<source> 
access IN ([| inputlookup lookup_accesses.csv 
| mvcombine delim="\",\"" Accesses
| nomv Accesses
| eval Accesses = "\"" + Accesses + "\""
| return $Accesses])
| fields <fields>

The problem occurs when the data inside contains the backslash char ("\"), in this case it does not work and returns zero results. Otherwise if the data inside the lookup doesn't contain the backslash char it works fine.
This lookup fields may contain file names and directories and we are trying to make it work for both cases.

Any help will be appreciated.

Regards.
Javier.

[isoutamo · Accepted solution]

Did it work if you change access IN to subquery which is format access = xyzzy OR access=zzz ...? Like

index=<index> source=source<source> 
[| inputlookup lookup_accesses.csv 
| mvcombine delim="\",\"" Accesses
| nomv Accesses
| eval Accesses = "\"" + Accesses + "\""
| rename Accesses as access
| format ]
| fields <fields>

r. Ismo 

[joshiro]

Hi, i just tried your solution and now it works, needed to make some modification to the SPL and the lookups:

index=<index> source=source<source> 
[| inputlookup lookup_accesses.csv | format ]
| fields <fields>

The fields inside the lookup are:
- filenames.
- directories (with single backslash, no escaping characters).

Thanks for the response.

Regards.

Javier.