Splunk Enterprise

How to replace backslash by double backslash using eval in search and props.conf

jay
Engager

for example :  C:\user\process  -->  C:\\user\\process

Labels (1)
Tags (1)
1 Solution

manan_amin
Explorer

In Eval, We can use string format function (replace) to replace "\" by two "\\". 

Here, We need to escape "\" two times,

One of the way to replace it,

 

props.conf 

EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")

 

in Search Query:

| eval new_path = replace(path ,"(\\\\)","\\\\\1")

View solution in original post

manan_amin
Explorer

In Eval, We can use string format function (replace) to replace "\" by two "\\". 

Here, We need to escape "\" two times,

One of the way to replace it,

 

props.conf 

EVAL-new_path = replace(path ,"(\\\\)","\\\\\1")

 

in Search Query:

| eval new_path = replace(path ,"(\\\\)","\\\\\1")

highsplunker
Contributor

why 4 backslashes?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...