How to escape the "\" escape character itself?

Antony_Chan — Thu, 18 Jul 2024 02:36:56 GMT

Dear community,

I'm trying to use the replace command in XQL to replace the "\" escape character and have so success.

When I tried with the double slash \\, the XQL will raise syntax error.

| alter test2 = replace(to_json_string(data), "\\", "")

Sample data:

["{\"ActionType\":\"Forward\",\"Recipients\":[\"john.doe@domain.com\"],\"ForwardFlags\":\"None\"}"]

Expected output:

["{"ActionType":"Forward","Recipients":["john.doe@domain.com"],"ForwardFlags":"None"}"]

Thank you in advance.

Re: How to escape the "\" escape character itself?

aspatil — Thu, 18 Jul 2024 07:15:40 GMT

Hello @Antony_Chan ,

The backslash is an escape character - we have to use triple quotes and double backslash to handle it. Please try and let me know if that works. Or kindly share your use case and sample query to have a look.

Regards,

Ashutosh

topic How to escape the "\" escape character itself? in Cortex XDR Discussions

How to escape the "\" escape character itself?

Re: How to escape the "\" escape character itself?