I've tried a bunch of different things, including all the ones suggested here, and none of them work (I'm running on 6.1.5, by the way). I can get them working in mode=sed in a splunk search rex, but not in SEDCMD. This, however totally works in SEDCMD: SEDCMD-RemoveBackslashes = s/\x5C{1}//g The \x5C by itself works in ... | rex mode=sed "s/\x5C//g" but not in SEDCMD for whatever reason. Adding the {1} was just a shot in the dark, but it works. It also works in search with mode=sed and rex. ... View more