Splunk Search

Macro for Backslash Substitution

ephemeric
Contributor

I have a macro that adds a backslash to an existing backslash:

 

[backslash(1)]
args = arg
definition = replace("$arg$", "(\\\\)", "\\\\\\\\")
iseval = 1

 

 This works:

 

index=perfmon counter=`backslash(\processor)`

 

 This fails when the arg has spaces:

 

index=perfmon counter=`backslash("\processor time")`

 

The expanded search string:

 

(counter=\\processor index=perfmon time)

 

How do I get:

index=perfmon counter="\\processor time"

Oh please show me my stupidity as I have been banging my head on the desk for hours... 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...