Splunk Search

Backslash escape problem

hbazan
Path Finder

Hi! I have a view, with this structure:

  <ExtendedFieldSearch>
      <HiddenSearch>
        <HiddenPostProcess/>
        <HiddenPostProcess/>
      </HiddenSearch>
      <HiddenSearch>
      </HiddenSearch>
      <HiddenSearch>
      </HiddenSearch>

And in the second and third hiddensearch the backslash is getting weirdly escaped. For instance, this:

<param name="search">
              <![CDATA[index=$selected_index$ "$appId$</applicationId>" | rex "SOMETHING: (?<Some>\w+)" | stats count by Some]]>
</param>

When the view is rendered and I go to "view results" the rex is like this:

rex "SOMETHING: (?<Some>\\\\w+)

The weird thing is that for the first hiddensearch and the postprocess it works fine. Someone knows what's happening?

chris
Motivator

Did you get an answer for this in the meantime? I've run into the same issue

0 Karma

gallantalex
Path Finder

This is pretty much the exact problem that I am having. I have am creating a view that does an xpath search. The search in the view xml configuration looks like this:

... | xpath "//Products/Product[@name=\"$ProductName$\"]/@version"

But when I try to use the search on this view it evaluates to something like this:

... | xpath "//Products/Product[@name=\\\\\\\\"CodeAnalyzer\\\\\\\\"]/@version"

The backslash multiplies by 8. There is no documentation for a view to escape backslashes. I tried escaping the quotes " but this is just the problem with the backslash. Without them the xpath does not work.

0 Karma

hbazan
Path Finder

I didn't get an answer for this issue, so I ended up doing everything with HiddenPostProcess

0 Karma

hbazan
Path Finder

[I think] It's the latest one (4.1.4 - 82743). One weird thing is that for the first hiddensearch and the inner hiddenpostprocess it works fine. The replacement is for the second and third hiddensearch. That's why I posted the structure.

0 Karma

sideview
SplunkTrust
SplunkTrust

what version of splunk is this happening on? We have had backslash escape problems like this in the past and if its an older version maybe (just maybe) we already fixed it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...