Help with basic regex

[jip31]

Hi

Is anybody can tell me what is the goal of this regex?

| regex ImagePath="\\\\\\\\"

As far as I know, it seems to search a character chain delimited by 4 backslash?

Thanks

[isoutamo]

Hi

here is @xpac 's excellent post about escaping \ on splunk https://community.splunk.com/t5/Splunk-Enterprise/How-many-escapes-quot-quot-do-I-need-in-conf-file-...

r. Ismo

[ITWhisperer · Accepted solution]

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @jip31,

we could better help you if you share a sample of your logs.

Anyway, 4 back slashes are often required wen in you logs you have a back slash that must be escaped to avoid that SPL interpretes it a control char.

Ciao.

Giuseppe