Splunk Search

problem with field that contains character "\\"

Path Finder


I have a log with this type of content: domain\\user. I have extracted this info with field extraction called src_user.

When I do a search with src_user=* | table src_user, the response shows domain\user instead of domain\\user. One of the \ characters is stripped.

Then when I am doing a searchFieldsToDisplay to get src_user value I get domain\user and I can not set a new search with this searchField value.

Does anyone know how to solve this?


Tags (2)


trying to see your regular expression because you must be missing something, and is the problem that must come. and also check if you have not escape "\" s inside.
without your expression regular and an example of data I do not guess more.

0 Karma

Esteemed Legend

If it is exactly as you have described, it has to be a bug and I would open a Support Case with Splunk right away.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!