You need one more backward slash for escape. This works fine with sample value.
|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"
You need one more backward slash for escape. This works fine with sample value.
|rex field=source "N:\\\logs\\\(?P<UID>[^_]+)"
Doesn't seem to work with either 2 or 4 backslashes as transform.
transforms.conf should require only two backslashes.
The rex
command takes a string - that string uses backslashes as its escape character, requiring extra backslashes. transforms.conf doesn't take a string in a programming sense, so there's one fewer layer of escaping going on.
Try with 4 backslashes.
That worked inline, thanks!
Any idea how to get this to work in a transform? I get same error when I save transform three slashes and it doesn't work with two.