I am doing some regex stuff by rex command and find some tricky behavior.
Error: I tried to use \ to escape the backslash in three places. Not sure which one doesn't work.
But, this regex works on regex101.
OK, let's try some other ways in the search to make it accepted by my Splunk as below:
This time, it works perfectly. Here is the confusing point. Why does "\" work at the beginning, but doesn't work for the second and third backslash. \x5c can be a good replacement. But, why "\\" works to escape single \?
As far as I'm aware, there is some double escaping going on, first from the search bar to the regex and then of course inside the regex.
To match a single \ in a string
you need \\ in your regex, to achieve that, you need \\\\ in the splunk search bar in the rex command.
The reason your second attempt seems to work is that you do not require splunk to match the full string from the start, so Splunk is not matching both backslashes at the start of the path, but ignores the first and then starts the match from the second backslash.