Splunk Search

Text function replace and "\"

osakachan
Communicator

Hello folks,

I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo".

I am testing it with this query

    | makeresults
    | eval user="qwerty\foo"
    | eval ruser=replace(user,"\\","\\")

In this case I have this error
Error in 'eval' command: Regex: \ at end of pattern

The same for:
| eval ruser=replace(user,"\","\\")

Using | eval ruser=replace(user,"\{1}","anything") , It does not show an error but nothing changes. The same for + or *.

Using | eval ruser=replace(user,"\\","a") shows the next error, and of course If use another " nothing will change.
Unbalanced quotes.

With | eval ruser=replace(user,"(.)\(.)","\1\\\2") no error but nothing changes and | eval ruser=replace(user,"(.)\(.)","\1\\\2") shows the next error:
Error in 'eval' command: Regex: unmatched closing parenthesis

Just in case tested | eval ruser=replace(user,"/\","/\/\") , error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\/\")'.

The only thing worked for reading \ was this regex:
| eval ruser=replace(user,"(.)\(.)","\1(\)(\)\2")

But the output I was unable to output a double \

Because I am unable to rex it a temporary solution was this.

| makeresults
| eval user="qwerty\foo"
| eval tuser=replace(user,"(.*)\\\(.*)","\1?\2")
| rex field=tuser "(?<u1>[^\?]+)\?(?<u2>[^\?]+)"
| eval ruser=u1+"\\\\"+u2

¿Someone know the way to use replace in this case to make things easy? Thanks 🙂

0 Karma
1 Solution

justinatpnnl
Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

View solution in original post

justinatpnnl
Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

osakachan
Communicator

So many banelings!!err.. I mean, \\\\\ 🙂

Works as intended, I did not understand the double scape so I've used 3 \ instead of 4 \ 🙂

Thanks for the answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...