Splunk Search

How to get raw string as input in custom search ?

thanhnhhe130698
Engager

Hi, I have a custom search get input as raw string, but when I combine splunk don't understand that, it always return error 
Example:
|example rawstring="{"EventCode": "13","EventType": "SetValue","TargetObject": "(?mi)Software[//\\\\]{0,2}Microsoft[//\\\\]{0,2}Windows[//\\\\]{0,2}CurrentVersion[//\\\\]{0,2}Run"}}" 
Can anyone help me pass it, thanks in advance



Labels (1)
Tags (1)
0 Karma

manjunathmeti
Champion

hi @thanhnhhe130698,

You have double quotes in the raw string, put a backslash before each double quote.

rawstring="{\"EventCode\": \"13\",\"EventType\": \"SetValue\",\"TargetObject\": \"(?mi)Software[//\\\\]{0,2}Microsoft[//\\\\]{0,2}Windows[//\\\\]{0,2}CurrentVersion[//\\\\]{0,2}Run\"}}"

 

If this reply helps you, a like would be appreciated.

thanhnhhe130698
Engager

Hi @manjunathmeti , thanks for your reply, it works but splunk still format string '//\\\\' to '//\\',do you have a way to fix this? thank you very much

Tags (1)
0 Karma

manjunathmeti
Champion

You need to escape a backslash character ( \ ). Use the sequence \\ to escape single \

rawstring="{\"EventCode\": \"13\",\"EventType\": \"SetValue\",\"TargetObject\": \"(?mi)Software[//\\\\\\\\]{0,2}Microsoft[//\\\\\\\\]{0,2}Windows[//\\\\\\\\]{0,2}CurrentVersion[//\\\\\\\\]{0,2}Run\"}}"

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...