Splunk Search

replace one backslash by double backslash

Communicator

Hello!
I need to provide search only in earliest source in my sourcetype.
I use this search request for this purposes:
sourcetype="mysourcetype" | stats earliest(source) as firstsource | search source=firstsource
But I get error "No results found".
I found that the firstsource of returns in the form of D:\MyFolder\Mysourcename.gz while for a successful search must have a value as D:\\MyFolder\\Mysourcename.gz
How can I replace \ to \\?

Tags (1)
0 Karma
1 Solution

Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

View solution in original post

Explorer

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")

 

 

0 Karma

Builder

There's something wacky about how the Splunk regex parser interprets backslashes. As a rule of thumb, to match a literal backslash you need one more than you think you do. This should work:

rex mode=sed field=foo "s/(\\\)/\1\1/g"

Builder

Hello, I tried adding this in CLI search job script using curl and getting no result, any idea? Thanks 🙂

0 Karma

Builder
SOLVED : needed to escape again : "s/(\\\\\)/\1\1/g"
0 Karma

Ultra Champion
sourcetype="mysourcetype" | stats earliest(source) as firstsource | rex field=firstsource mode=sed "s/\\/\\\\/g" | search source=firstsource

I think this will work. Note that you'll probably need to escape the backslashes within the rex statement, like above.


UPDATE:

There seems to some issues with backslashes and sed, apparently. Perhaps this can give some guidance.

http://splunk-base.splunk.com/answers/24026/sedcmd-special-requirement-for-backslash

/K

View solution in original post

Communicator

I get error "Error in 'rex' command: Failed to initialize sed. Failed to parse the regex to replace."

0 Karma