tranform field url_address by rempving \/ (backslash) from value

Question

I would like to remove \ (backslash) from my field url_address that is extracted using this regex :

Address: : (?<URL>.*?)\\r

my actually output is : blablahost:80\/api\/cars\/bmw\/g\/v1

Èxpected output is : blablahost:80/api/cars/bmw/g/v1

Is it possible with Splunk transformation to remove that backslash from my url_address ?

Many Thanks

Answer 1

You can use the rex command in sed mode to fix that at search time. | rex field=URL mode=sed "s/\//g".

Or do it automatically in props.conf. This applies to all fields so it's a little different so as not to strip too many backslashes.

[mysourcetype]
SEDCMD-fixurl = s:\\/:/:g