Replace in SPL2 not working like SPL

[KeithH]

Hi,

I am having trouble getting replace to work correctly in Ingest Processor and have this example.

In SPL I can run this search:

| makeresults 
| eval test = "AAABBBCCC" 
| eval text = "\\\"test\\\":\\\"" 
| eval output = replace(test, "BBB", text)

and I will get this output

But if I run this in a Ingest Processor pipeline

| eval test = "AAABBBCCC"
| eval text = "\\\"test\\\":\\\""
| eval output = replace(test, "BBB", text)

The result is:

Note the slashes before the doublequotes have gone.

Why have they gone?

How do I ensure they are retained by Ingest Processor.

This is a simplified example of what I am trying to do but this is the core of the problem I am having.

Thanks

[KeithH]

Further Update:  Splunk fixed the bug and expect it to be released to Splunk Cloud in the next couple of weeks.

[bowesmana]

Splunk uses PCRE and also the search parser will handle unescaping, whereas Ingest Processor uses RE2 - although that appears to be changing. So you probably need to use 2 \\ characters, not 3 as the Splunk parser will take away one.

But validate

[KeithH]

Hi Bowesmana,

I tried that too but the editor wont even let me save it that way:

Also note that while this simple example illustrates the problem the real data is extracted by  previous rex command so my ability to manipulate it is limited.
Thanks

[bowesmana]

Mmm, OK, I was going to suggest the SPL2 channel in the Splunk Slack group, but I see you already found that.

[KeithH]

Oh for some reason the image of the SPL2 result didnt post so here it is:

[KeithH]

UPDATE:  I pursued this via another angle and have had agreement from Splunk that this seems to be a bug and that they will put some work into it though I dont have any reference number or ETA as yet.

In the meantime I am use the rex command with mode=sed to achieve something acceptable but not as good as I would have liked.