Splunk Search

Macro for Backslash Substitution

ephemeric
Contributor

I have a macro that adds a backslash to an existing backslash:

 

[backslash(1)]
args = arg
definition = replace("$arg$", "(\\\\)", "\\\\\\\\")
iseval = 1

 

 This works:

 

index=perfmon counter=`backslash(\processor)`

 

 This fails when the arg has spaces:

 

index=perfmon counter=`backslash("\processor time")`

 

The expanded search string:

 

(counter=\\processor index=perfmon time)

 

How do I get:

index=perfmon counter="\\processor time"

Oh please show me my stupidity as I have been banging my head on the desk for hours... 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...