Simply echoing xpac's excellent solution with my own, since I've encountered this as well, but perhaps another wording will help future readers as well. When you write regex in a |rex command, backslashes must be used carefully, because there are multiple levels of escaping. The first is SPL level escaping, because the rex command accepts the argument for the regular expression in quotes, which means you must escape the " character with \ so your regex string can include it. Call this the SPL parsing step. For this to work, \ must also be a special character for the SPL parser. All this only applies to SPL commands like |rex and |regex that accept the regular expression as a string bounded by quotes. For these though, all " and \ characters must be escaped so they appear as literal in the true regular expression For the regular expression itself, " is not a special character, but \ is. So if you need to look for something like a literal \ in the message, your regex must specify \\, and your SPL must specify \\\\. SPL escapes this once to \\, which regex treats as a literal \. This is very annoying for cases where your message is escaped json formatting, as the string \" appears in the message itself. If you need to search for this in a |rex command, you'll need \\\\\". For other methods of regex written in Splunk .conf files like field extractions, transforms, LINE_BREAKER, timestamp lookahead, etc., the regular expression syntax does not need to be escaped again because there's no SPL parser interpreting it first. Example: message you're searching: {\"key\": \"value\"} regex you want applied (and what should work in .conf files): {\\"key\\": \\"value\\"} how you must write the SPL command: | rex field=_raw "{\\\\\"key\\\\\": \\\\\"value\\\\\"}"
... View more
