Hi all, I'm trying to dynamically replace single backslashes with double backslashes in a search string and use the result to search across a field (e.g., FileSource). Here's what I’ve tried: | eval text_search="*\\Test\abc\test\abc\xxx\OUT\*" | eval text_search_escaped=replace(text_search, "\\\\", "\\\\\\\\") | search FileSource=text_search_escaped The output of text_search_escaped looks correct (with double backslashes), and if I run a manual search like below, I do get results: index=... FileSource="*\\Test\\abc\\test\\abc\\xxx\\OUT\\*" However, when I try to use the text_search_escaped variable inside search, I get no results. Am I missing something in how Splunk treats dynamic fields inside search? Is there a better way to pass an escaped Windows-style path to a search clause?
... View more
