Splunk Search

Why when I use "\\" it shows results with only one "\"

rasamur
Engager

I'm currently creating a search and in my search I entered the following

source="FileName.csv" \ OR SMS

In the results it shows events with a Single "\" and double "\". I need to show results with two "\" not only one.

I've tried:

\
"\"
punct=*\*

But still it shows only results with only one "\". What can be done so the results show results where there is actually two "\"?

Regards

Tags (1)
0 Karma
1 Solution

sbbadri
Motivator

use "\" for single slash and use "\\" for double slash. Because splunk use slash as an escape character.

View solution in original post

woodcock
Esteemed Legend

Use \\.

0 Karma

sbbadri
Motivator

use "\" for single slash and use "\\" for double slash. Because splunk use slash as an escape character.

rasamur
Engager

Thank you for the help.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...