replace one backslash by double backslash

[ryastrebov]

Hello!
I need to provide search only in earliest source in my sourcetype.
I use this search request for this purposes:
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
But I get error "No results found".
I found that the firstsource of returns in the form of D:\MyFolder\Mysourcename.gz while for a successful search must have a value as D:\\MyFolder\\Mysourcename.gz
How can I replace \ to \\?

[manan_amin]

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")

[cphair]

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work:

rex mode=sed field=foo "s/(\\\)/\1\1/g"

[splunkreal]

Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂

[splunkreal]

SOLVED : needed to escape again : "s/(\\\\\)/\1\1/g"

[kristian_kolb · Accepted solution]

sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.

---

UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

[ryastrebov]

I get error "Error in 'rex' command: Failed to initialize sed. Failed to parse the regex to replace."