Splunk Search

Help with basic regex

jip31
Motivator

Hi

Is anybody can tell me what is the goal of this regex?

| regex ImagePath="\\\\\\\\"

As far as I know, it seems to search a character chain delimited by 4 backslash?

Thanks

 

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

we could better help you if you share a sample of your logs.

Anyway, 4 back slashes are often required wen in you logs you have a back slash that must be escaped to avoid that SPL interpretes it a control char.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...