Splunk Search

How to add an additional backslash to source?

edwinmae
Path Finder

I have an input that offers me x sources
index="xxxxx" sourcetype=xxxxx | dedup source | table source

The problem is when I open the panel in a search it shows me the source with a single \ and it needs two \ to give me the actual output

It seems I am close when using | rex mode=sed field=source "s/\\{1}/\\\//g" | dedup source | table source

The output is now:
source=D:\/xxxx\/xxxxx\/xxxx\/xxxxx\/xxxx\/xxxx.log

I tried to search and tried different options, but didn't found the correct rex 'line' that also changes the / into \ , in order to get the output:
source=D:\xxxx\xxxxx\xxxx\xxxxx\xxxx\xxxx.log

0 Karma

sdchakraborty
Contributor

Hi,

Can you try the below code,

|  eval source = replace(source,"\\\\","\\\\\\\\")

Sid

edwinmae
Path Finder

Excellent !

0 Karma

sdchakraborty
Contributor

Welcome. Please accept is as answer when you get time. Have a nice day.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...