Splunk Search

How to add an additional backslash to source?

edwinmae
Path Finder

I have an input that offers me x sources
index="xxxxx" sourcetype=xxxxx | dedup source | table source

The problem is when I open the panel in a search it shows me the source with a single \ and it needs two \ to give me the actual output

It seems I am close when using | rex mode=sed field=source "s/\\{1}/\\\//g" | dedup source | table source

The output is now:
source=D:\/xxxx\/xxxxx\/xxxx\/xxxxx\/xxxx\/xxxx.log

I tried to search and tried different options, but didn't found the correct rex 'line' that also changes the / into \ , in order to get the output:
source=D:\xxxx\xxxxx\xxxx\xxxxx\xxxx\xxxx.log

0 Karma

sdchakraborty
Contributor

Hi,

Can you try the below code,

|  eval source = replace(source,"\\\\","\\\\\\\\")

Sid

edwinmae
Path Finder

Excellent !

0 Karma

sdchakraborty
Contributor

Welcome. Please accept is as answer when you get time. Have a nice day.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...