Search for multiple apperances of a pattern in a field

[KMoryson]

Hi, is there a way to search for more than one appearance of a pattern in a string?

For example:
Command
cmd.exe c:\windows\\\\\\\\sytem32\[...]
cmd.exe c:\windows\sytem32\[...]

I would want to search for rows with more than single consecutive "\" , in case of above only first row to be returned.

[ITWhisperer]

| regex _raw="\\\\\\\\"

[KMoryson]

This only matches to this specific amount of backslashes, I want to match for any number above one

[ITWhisperer · Accepted solution]

Have you even tried it?

Due to the way splunk escapes backslash in regex expressions, you need 4 backslashes to match a single backslash in the field, therefore 8 backslashes (as I have used), will find anything more than 1 in the field.

| makeresults
| eval _raw="cmd.exe c:\\windows\\\\\\\\\\\\\\\\sytem32\\[...]
cmd.exe c:\\\\windows\\\\sytem32\\\\[...]
cmd.exe c:\\windows\\sytem32\\[...]"
| multikv noheader=t
| regex _raw="\\\\\\\\"

[KMoryson]

So sorry, you are right, this works wonderfully, thank you for help