Splunk Search

How to add an escape \ to a value?

ccsfdave
Builder

Greetings,

I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username. I would like to use the results as a token in the next panel, but in order to do that I need it to be in the form of "Domain\\username". Does anyone have a pointer on how I may accomplish this?

Thanks

0 Karma
1 Solution

ccsfdave
Builder

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"

View solution in original post

0 Karma

ccsfdave
Builder

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"
0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=username mode=sed "s/\\\/\\\\\\\/"
0 Karma

cmccririe
Splunk Employee
Splunk Employee

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra .

  1. |rex field=usernames ""(?[^\]+)\(?.*)"
  2. |eval username = domain . "\\" . user
  3. |stats count by username

This will give you values of the username field with the additional backslash for your escape character.

Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...