I have a splunk query as below which contains a lot of backslashes
index="ABC" os="Win" FileName="*\\Programs\\Startup\\*" | rex field=FileName "Users\\\(?<username>[^\\\]+)."
Now, I now that when I tried to add this in savedseacrhes.conf it wont work as expected as in Splunk it breaks the line when it sees backslash.
Any suggestion on how we can add it to saved searches.conf ?
I've seen lots of backslashes in savedsearches.conf. The only special use for them is as a line continuation character and that's only when \ is the last character on a line. Have you tried putting that query in the config file?