Hi guys how are you doing?   I'm reading this link Solved: How to use replace in search? - Splunk Community but I can't get results with what I want to do. From a search I get a field called "user_name" with the following format "DOMAIN\\\\USER" what I want to do is to replace \\\\ with only one \ and get "DOMAIN\USER"   If I use the query that I saw i the link attached I get this error   If I add one " I get this   How can I replace \\\\ for \ ?   Regards. Martín. ... View more