Splunk Search

replace one backslash by double backslash

ryastrebov
Communicator

Hello!
I need to provide search only in earliest source in my sourcetype.
I use this search request for this purposes:
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
But I get error "No results found".
I found that the firstsource of returns in the form of D:\MyFolder\Mysourcename.gz while for a successful search must have a value as D:\\MyFolder\\Mysourcename.gz
How can I replace \ to \\?

Tags (1)
1 Solution

kristian_kolb
Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

View solution in original post

manan_amin
Explorer

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")

 

 

cphair
Builder

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work:

rex mode=sed field=foo "s/(\\\)/\1\1/g"

splunkreal
Motivator

Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂

* If this helps, please upvote or accept solution if it solved *
0 Karma

splunkreal
Motivator
SOLVED : needed to escape again : "s/(\\\\\)/\1\1/g"
* If this helps, please upvote or accept solution if it solved *
0 Karma

kristian_kolb
Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

ryastrebov
Communicator

I get error "Error in 'rex' command: Failed to initialize sed. Failed to parse the regex to replace."

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...