- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-17-2024 07:36 PM
Dear community,
I'm trying to use the replace command in XQL to replace the "\" escape character and have so success.
When I tried with the double slash \\, the XQL will raise syntax error.
| alter test2 = replace(to_json_string(data), "\\", "")
Sample data:
["{\"ActionType\":\"Forward\",\"Recipients\":[\"john.doe@domain.com\"],\"ForwardFlags\":\"None\"}"]
Expected output:
["{"ActionType":"Forward","Recipients":["john.doe@domain.com"],"ForwardFlags":"None"}"]
Thank you in advance.
Cortex XDR
07-18-2024 12:15 AM
Hello @Antony_Chan ,
The backslash is an escape character - we have to use triple quotes and double backslash to handle it. Please try and let me know if that works. Or kindly share your use case and sample query to have a look.
Regards,
Ashutosh
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!