How to add an escape \ to a value?

[ccsfdave]

Greetings,

I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username. I would like to use the results as a token in the next panel, but in order to do that I need it to be in the form of "Domain\\username". Does anyone have a pointer on how I may accomplish this?

Thanks

[ccsfdave · Accepted solution]

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"

[woodcock]

Like this:

... | rex field=username mode=sed "s/\\\/\\\\\\\/"

[cmccririe]

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra .

1. |rex field=usernames ""(?[^\]+)\(?.*)"
2. |eval username = domain . "\\" . user
3. |stats count by username

This will give you values of the username field with the additional backslash for your escape character.