Tricky behavior of escaping backslash in regex

[ypeng_splunk]

Hey folks,

I am doing some regex stuff by rex command and find some tricky behavior.

Error: I tried to use \ to escape the backslash in three places. Not sure which one doesn't work.

But, this regex works on regex101.

OK, let's try some other ways in the search to make it accepted by my Splunk as below:

This time, it works perfectly. Here is the confusing point. Why does "\" work at the beginning, but doesn't work for the second and third backslash.
\x5c can be a good replacement. But, why "\\" works to escape single \?

Any idea is appreciated.

[FrankVl]

As far as I'm aware, there is some double escaping going on, first from the search bar to the regex and then of course inside the regex.

To match a single \ in a string
you need \\ in your regex, to achieve that, you need \\\\ in the splunk search bar in the rex command.

The reason your second attempt seems to work is that you do not require splunk to match the full string from the start, so Splunk is not matching both backslashes at the start of the path, but ignores the first and then starts the match from the second backslash.

But I do agree that is a bit tricky and confusing, also because it doesn't seem to correspond to what is in documentation: http://docs.splunk.com/Documentation/Splunk/7.0.1/Search/SPLandregularexpressions

Also somehow your eval requires 4 backslashes to make the field start with 2 backslashes but no additional backslashes for the backslashes in the middle of your string...

PS: the code segment parser here on splunk answers also seems to struggle a bit with such backslash characters 😛

[ifeldshteyn]

Thanks, I didn't realize I had to put in 4 backslashes for one.