how to replace \ with \\ in eval statement

[reney44]

i expect var1="d:\test\data.csv" but i got

it shows mismatch or missing closing parenthesis

var="d:\test\data.csv"
|eval var1=replace(var,"\","\\")


[javiergn · Accepted solution]

If all you are trying to do is to replace one backslash with two then you can do the following:

| stats count
| eval var="d:\\test\\data.csv"
| eval var1=replace(var,"\\\\","\\\\\\")

(Ignore the stats count as I used this to test)
Output:

Take a look at the following links if you want to read more about it:

https://docs.splunk.com/Documentation/Splunk/latest/Search/SPLandregularexpressions#Backslash_charac...
https://answers.splunk.com/answers/623193/tricky-behavior-of-escaping-backslash-in-regex.html#answer...

Regards,
J

[p_gurav]

This may help:

https://answers.splunk.com/answers/84781/replace-one-backslash-by-double-backslash.html