Search Events with "\" character

[jnahuelperez35]

I was making some SQL dashboard and i can't use some variables cause one of them is the kerberos USER that comes like:
"MyDomain\User1"
MyDomain\User2"
MyDomain\User3"
MyDomain\User4"

My search is

index="mssql" sourcetype="mssql:audit"
| eval user=lower(server_principal_name)
| search user="$m_user$"
| table _time name user statement

Where m_user is a dropdown input that populate this way:

index="mssql" sourcetype="mssql:audit" statement!="" statement!="--*" server_principal_name!="*SYSTEM"
| eval user=lower(server_principal_name)
| dedup user

(I use a lower function cause server_principal_name can be "MyDomain\USer1" or ""MyDomain\user1")

The thing is when m_user get's the value (for example) "MyDomain\User1" the search didn't find result, but if i look for "MyDomain\user1" the search finds the events. I was trying to do a eval thing like:

index="mssql" sourcetype="mssql:audit"
    | eval user=lower(server_principal_name)
    | search user="$m_user$"
    | eval user=replace(user,".+\\.+","\\\\")
    | table _time name user statement

without success. Some idea?

[niketn]

@jnahuelperez35, search match is not case-sensitive. So there is no need for | eval user=lower(server_principal_name) in Dropdown query or in your search. Also it is better to filter results upfront in the base search when you pull events from raw data, rather than filtering afterwards i.e.

index="mssql" sourcetype="mssql:audit" server_principal_name=$m_user|s$
| table _time name user statement

You need to use token filter to use the token as String. In this case server_principal_name=$m_user|s$
Following is a run anywhere example based on Sample Data and code provided.

<form>
  <label>Dropdown with backslash</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="m_user" searchWhenChanged="true">
      <label>Select User</label>
      <choice value="*">All</choice>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>| makeresults
| fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| dedup user</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
|  fields - _time
| eval user="MyDomain\User1;MyDomain\User2;MyDomain\User3;MyDomain\User4"
| makemv user delim=";"
| mvexpand user
| search user=$m_user|s$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

[wildcats12 · Accepted solution]

In your original search, try changing:
| search user="$m_user$"
to:
| where user="$m_user$"

The where command interprets quoted strings as literals and should do a better job of comparing strings with an escape character.

[jnahuelperez35]

thanks for the answer
using where i can search for "mydomain\user" but i can't use with "*" character that means "hey ,give me events of any user".
Any idea?

[wildcats12]

Yes, you can still use a wildcard search within a where, but the syntax is different. Try the like() function:
| where like(user,"%")

The "%" character is the equivalent of "*" within where, eval, etc when used inside like().