Splunk Search

Text function replace and "\"

Communicator

Hello folks,

I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo".

I am testing it with this query

    | makeresults
    | eval user="qwerty\foo"
    | eval ruser=replace(user,"\\","\\")

In this case I have this error
Error in 'eval' command: Regex: \ at end of pattern

The same for:
| eval ruser=replace(user,"\","\\")

Using | eval ruser=replace(user,"\{1}","anything") , It does not show an error but nothing changes. The same for + or *.

Using | eval ruser=replace(user,"\\","a") shows the next error, and of course If use another " nothing will change.
Unbalanced quotes.

With | eval ruser=replace(user,"(.)\(.)","\1\\\2") no error but nothing changes and | eval ruser=replace(user,"(.)\(.)","\1\\\2") shows the next error:
Error in 'eval' command: Regex: unmatched closing parenthesis

Just in case tested | eval ruser=replace(user,"/\","/\/\") , error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\/\")'.

The only thing worked for reading \ was this regex:
| eval ruser=replace(user,"(.)\(.)","\1(\)(\)\2")

But the output I was unable to output a double \

Because I am unable to rex it a temporary solution was this.

| makeresults
| eval user="qwerty\foo"
| eval tuser=replace(user,"(.*)\\\(.*)","\1?\2")
| rex field=tuser "(?<u1>[^\?]+)\?(?<u2>[^\?]+)"
| eval ruser=u1+"\\\\"+u2

¿Someone know the way to use replace in this case to make things easy? Thanks 🙂

0 Karma
1 Solution

Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

View solution in original post

Communicator

Try this:

| makeresults 
| eval user="qwerty\foo" 
| eval ruser=replace(user,"\\\\","\\\\\\\\")

In SPL, the escape has to be escaped so everything doubles. If you want to find a backlash, you would normally look for \. But in SPL you have to escape your escape: \ and then escape the backslash you are trying to find with another \.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Search/SPLandregularexpressions

View solution in original post

Communicator

So many banelings!!err.. I mean, \\\\\ 🙂

Works as intended, I did not understand the double scape so I've used 3 \ instead of 4 \ 🙂

Thanks for the answer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!