Splunk Search

Text function replace and "\"

osakachan
Communicator

Hello folks,

I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo".

I am testing it with this query

    | makeresults
    | eval user="qwerty\foo"
    | eval ruser=replace(user,"\\","\\")

In this case I have this error
Error in 'eval' command: Regex: \ at end of pattern

The same for:
| eval ruser=replace(user,"\","\\")

Using | eval ruser=replace(user,"\{1}","anything") , It does not show an error but nothing changes. The same for + or *.

Using | eval ruser=replace(user,"\\","a") shows the next error, and of course If use another " nothing will change.
Unbalanced quotes.

With | eval ruser=replace(user,"(.)\(.)","\1\\\2") no error but nothing changes and | eval ruser=replace(user,"(.)\(.)","\1\\\2") shows the next error:
Error in 'eval' command: Regex: unmatched closing parenthesis

Just in case tested | eval ruser=replace(user,"/\","/\/\") , error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\/\")'.

The only thing worked for reading \ was this regex:
| eval ruser=replace(user,"(.)\(.)","\1(\)(\)\2")

But the output I was unable to output a double \

Because I am unable to rex it a temporary solution was this.

| makeresults
| eval user="qwerty\foo"
| eval tuser=replace(user,"(.*)\\\(.*)","\1?\2")
| rex field=tuser "(?<u1>[^\?]+)\?(?<u2>[^\?]+)"
| eval ruser=u1+"\\\\"+u2

¿Someone know the way to use replace in this case to make things easy? Thanks 🙂

0 Karma
1 Solution

justinatpnnl
Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

View solution in original post

justinatpnnl
Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

osakachan
Communicator

So many banelings!!err.. I mean, \\\\\ 🙂

Works as intended, I did not understand the double scape so I've used 3 \ instead of 4 \ 🙂

Thanks for the answer.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...