Splunk Search

How to add an escape \ to a value?

ccsfdave
Builder

Greetings,

I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username. I would like to use the results as a token in the next panel, but in order to do that I need it to be in the form of "Domain\\username". Does anyone have a pointer on how I may accomplish this?

Thanks

0 Karma
1 Solution

ccsfdave
Builder

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"

View solution in original post

0 Karma

ccsfdave
Builder

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=username mode=sed "s/\\\/\\\\\\\/"
0 Karma

cmccririe
Splunk Employee
Splunk Employee

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra .

  1. |rex field=usernames ""(?[^\]+)\(?.*)"
  2. |eval username = domain . "\\" . user
  3. |stats count by username

This will give you values of the username field with the additional backslash for your escape character.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...