Splunk Search

How to Regex match literal \U in directory path

frbuser
Path Finder

I am trying to match a directory path including the string "\Users" but Splunk is throwing an error:

 

| rex field=TargetFilename "C:\\Users\\\w+\\AppData\\(?<File_Dir>.*)\."

 

Error in 'rex' command: Encountered the following error while compiling the regex 'C:\Users\\w+\AppData\(?<File_Dir>.*)\.': Regex: PCRE does not support \L, \l, \N{name}, \U, or \u.

How can I literally match the path?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Splunk rex requires you to double up backslashes when trying to escape them

| makeresults
| eval TargetFilename="C:\\Users\\abc\\AppData\\tom.**bleep**.harry"
| rex field=TargetFilename "C:\\\\Users\\\\\w+\\\\AppData\\\\(?<File_Dir>.*)\."

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk rex requires you to double up backslashes when trying to escape them

| makeresults
| eval TargetFilename="C:\\Users\\abc\\AppData\\tom.**bleep**.harry"
| rex field=TargetFilename "C:\\\\Users\\\\\w+\\\\AppData\\\\(?<File_Dir>.*)\."
0 Karma

frbuser
Path Finder

@ITWhisperer 

The actual directory is something like this, "C:\Users\abc\Downloads\file.exe"

In your example, 4 backslashes would match literal 2 consecutive backslashes such as "\\" no?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

No, you need 4 backslashes to match with 1 backslash

That is a runanywhere example, just copy it into a search in splunk and look at the _raw field and the result

0 Karma

frbuser
Path Finder

Ok I see that. 

But how come in your eval statement you needed only 2 backslashes for 1 literal backslash?

I also tried changing it to one literal backslash in the eval and it still produce 1 literal backslash in the resulting value?

0 Karma

PickleRick
Ultra Champion

There are two levels of escaping in play here.

If you just do "\\" i  a regex definition, splunk parsing the search and creating the string variable representing the regex will escape the backslash. That's the first level of escaping.

Thus if you do "\\\\" splunk creates a string consisting of two consecutive backslashes.

Now this string is getting supplied to the regex processor which also needs the backslash to be escaped to be treated as a literal backslash character.

So you need "\\\\" to be properly escaped (twice) in order to match single backslash character.

With eval you have only one level of escaping since you're only building a string, not processing regex afterwards.

Just be glad that you're not trying to write a bash script. Proper escaping when you want to supply the arguments somewhere can give you a migraine XD

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The backslash has to be escaped with a backslash in a string (for the eval).

Look at the _raw field created by the search, it only has single backslashes in, just like your data.

For the rex, the string is passed through as a string and has to be escaped a second time, hence the doubling up.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...