Backslash escape problem

[hbazan]

Hi! I have a view, with this structure:

  <ExtendedFieldSearch>
      <HiddenSearch>
        <HiddenPostProcess/>
        <HiddenPostProcess/>
      </HiddenSearch>
      <HiddenSearch>
      </HiddenSearch>
      <HiddenSearch>
      </HiddenSearch>

And in the second and third hiddensearch the backslash is getting weirdly escaped. For instance, this:

<param name="search">
              <![CDATA[index=$selected_index$ "$appId$</applicationId>" | rex "SOMETHING: (?<Some>\w+)" | stats count by Some]]>
</param>

When the view is rendered and I go to "view results" the rex is like this:

rex "SOMETHING: (?<Some>\\\\w+)

The weird thing is that for the first hiddensearch and the postprocess it works fine. Someone knows what's happening?

[chris]

Did you get an answer for this in the meantime? I've run into the same issue

[gallantalex]

This is pretty much the exact problem that I am having. I have am creating a view that does an xpath search. The search in the view xml configuration looks like this:

... | xpath "//Products/Product[@name=\"$ProductName$\"]/@version"

But when I try to use the search on this view it evaluates to something like this:

... | xpath "//Products/Product[@name=\\\\\\\\"CodeAnalyzer\\\\\\\\"]/@version"

The backslash multiplies by 8. There is no documentation for a view to escape backslashes. I tried escaping the quotes " but this is just the problem with the backslash. Without them the xpath does not work.

[hbazan]

I didn't get an answer for this issue, so I ended up doing everything with HiddenPostProcess

[hbazan]

[I think] It's the latest one (4.1.4 - 82743). One weird thing is that for the first hiddensearch and the inner hiddenpostprocess it works fine. The replacement is for the second and third hiddensearch. That's why I posted the structure.

[sideview]

what version of splunk is this happening on? We have had backslash escape problems like this in the past and if its an older version maybe (just maybe) we already fixed it.