Hello folks, I am experiencing problems to use replace to change a field value like "qwerty\foo" to "qwerty\foo". I am testing it with this query | makeresults | eval user="qwerty\foo" | eval ruser=replace(user,"\\","\\") In this case I have this error Error in 'eval' command: Regex: \ at end of pattern The same for: | eval ruser=replace(user,"\","\\") Using | eval ruser=replace(user,"\{1}","anything") , It does not show an error but nothing changes. The same for + or *. Using | eval ruser=replace(user,"\\","a") shows the next error, and of course If use another " nothing will change. Unbalanced quotes. With | eval ruser=replace(user,"(.)\(.)","\1\\\2") no error but nothing changes and | eval ruser=replace(user,"(.)\(.)","\1\\\2") shows the next error: Error in 'eval' command: Regex: unmatched closing parenthesis Just in case tested | eval ruser=replace(user,"/\","/\/\") , error Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\/\")'. The only thing worked for reading \ was this regex: | eval ruser=replace(user,"(.)\(.)","\1(\)(\)\2") But the output I was unable to output a double \ Because I am unable to rex it a temporary solution was this. | makeresults | eval user="qwerty\foo" | eval tuser=replace(user,"(.*)\\\(.*)","\1?\2") | rex field=tuser "(?<u1>[^\?]+)\?(?<u2>[^\?]+)" | eval ruser=u1+"\\\\"+u2 ¿Someone know the way to use replace in this case to make things easy? Thanks 🙂 ... View more

When doing a Correlation Search in ES, I want to save it in my own Apps, but they don't show in the drop-down. I can see them if I query: | REST /services/apps/local splunk_server=local And, for example, I can select one of the Apps when I do an Alert. ... View more