Splunk Search
Highlighted

How to add an escape \ to a value?

Builder

Greetings,

I am using a form and the dynamic inputs is a table of usernames. The search results in Domain\username. I would like to use the results as a token in the next panel, but in order to do that I need it to be in the form of "Domain\\username". Does anyone have a pointer on how I may accomplish this?

Thanks

0 Karma
Highlighted

Re: How to add an escape \ to a value?

Splunk Employee
Splunk Employee

I'm not sure if this is the cleanest way to do this but it works. In the dynamic input field add a rex statement to your search parse out Domain and username into two fields and then concatenate them back together with an extra .

  1. |rex field=usernames ""(?[^\]+)\(?.*)"
  2. |eval username = domain . "\\" . user
  3. |stats count by username

This will give you values of the username field with the additional backslash for your escape character.

Highlighted

Re: How to add an escape \ to a value?

Esteemed Legend

Like this:

... | rex field=username mode=sed "s/\\\/\\\\\\\/"
0 Karma
Highlighted

Re: How to add an escape \ to a value?

Builder

This is what ended up working:

... |rex field=blah "(?<domain>.*)\\\(?<username>.*)"

View solution in original post

0 Karma