Splunk Search

Help with basic regex

jip31
Motivator

Hi

Is anybody can tell me what is the goal of this regex?

| regex ImagePath="\\\\\\\\"

As far as I know, it seems to search a character chain delimited by 4 backslash?

Thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As @gcusello says, backslashes have to be escaped. The way regex works is that the strings are processed twice, so backslashes have to be escaped again, so to match to a backslash, you need four backslashes in the expression for each backslash you are trying to match to. This means that your expression is looking for a double backslash (\\) in ImagePath.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

we could better help you if you share a sample of your logs.

Anyway, 4 back slashes are often required wen in you logs you have a back slash that must be escaped to avoid that SPL interpretes it a control char.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...