Hi @yeahnah  Basically, I have a SPL that detects several files modification within short time as part as possible ransomware infection.  Unfortunately, I cannot share the whole search since due to security reasons. What I can tell you is that the search uses a couple of data models to first provide information such as process name and object name, then identifies several files or folder modification.  We have identified this search produces several False Positive from regular business activities so we were trying to whitelist those using a lookup that contains some relevant fields to later be exclude/whitelist.  If I run this specific portion of the search by itself it looks appropriately without adding the double back slash  | inputlookup whitelist | fields  whitelisted_process_name  | rename whitelisted_process_name as process_name | format | rex mode=sed field=search "s/\\\\\\\/\\\/g" Result: (process_name="C:/Program Files/Computer/) But whenever I implement this portion of the search to the rest of the search to verify actual real results it adds again the double back lash.  Result seeing in job inspector: (process_name="C://Program Files//Computer//) Search estructure example 1. Datamodel=File_or_Folder_Modification calling important files. 2.Some field manipulation 3.Another data model to verify process id or other file values modification 4.Lookup related commands to attempt whitelisting. 5. Stats The issue in here is that if someone goes into the lookup and enters a value to be whitelist with a single backlash it will not be match because the actual lookup is looking for double backlash    Thank you very much for the help.         ... View more

Thank you @richgalloway  I appreciate the help. ... View more