Splunk Search

replace one backslash by double backslash

ryastrebov
Communicator

Hello!
I need to provide search only in earliest source in my sourcetype.
I use this search request for this purposes:
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
But I get error "No results found".
I found that the firstsource of returns in the form of D:\MyFolder\Mysourcename.gz while for a successful search must have a value as D:\\MyFolder\\Mysourcename.gz
How can I replace \ to \\?

Tags (1)
1 Solution

kristian_kolb
Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

View solution in original post

manan_amin
Explorer

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")

 

 

cphair
Builder

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work:

rex mode=sed field=foo "s/(\\\)/\1\1/g"

splunkreal
Motivator

Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂

* If this helps, please upvote or accept solution if it solved *
0 Karma

splunkreal
Motivator
SOLVED : needed to escape again : "s/(\\\\\)/\1\1/g"
* If this helps, please upvote or accept solution if it solved *
0 Karma

kristian_kolb
Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

ryastrebov
Communicator

I get error "Error in 'rex' command: Failed to initialize sed. Failed to parse the regex to replace."

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...