Splunk Enterprise

How to replace backslash by double backslash using eval in search and props.conf

jay
Engager

for example :  C:\user\process  -->  C:\\user\\process

Labels (1)
Tags (1)
1 Solution

manan_amin
Explorer

In Eval, We can use string format function (replace) to replace "\" by two "\\". 

Here, We need to escape "\" two times,

One of the way to replace it,

 

props.conf 

EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")

 

in Search Query:

| eval new_path = replace(path ,"(\\\\)","\\\\\1")

View solution in original post

manan_amin
Explorer

In Eval, We can use string format function (replace) to replace "\" by two "\\". 

Here, We need to escape "\" two times,

One of the way to replace it,

 

props.conf 

EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")

 

in Search Query:

| eval new_path = replace(path ,"(\\\\)","\\\\\1")

highsplunker
Contributor

why 4 backslashes?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...