Skip to main content

How am I supposed to check if a UDM field ends with $. 

Note that the $ symbol can be present anywhere. but I only want to check if it is in the end. 
Can somebody help.









@jstoner 

hostname = /\\$$/

 



  • /: The forward slashes at the beginning and end are delimiters. They mark the start and end of the regular expression pattern.

  • \\$: The dollar sign ($) usually has a special meaning in regular expressions: it signifies the end of a string (or the end of a line in multiline mode). However, here it is preceded by a backslash (\\). This backslash is an escape character. It tells the regex engine to treat the following dollar sign as a literal character, not as the special end-of-string anchor.

  • $: As mentioned before, the dollar sign without an escape character would normally match the end of a string. Here it's escaped, so it's just looking for a dollar sign.

  • $ (at the end): This is the special character $, which is not escaped, acting as the end-of-string anchor.


(explanation courtesy of Gemini)


 




This is the error I am getting : 

 

tokenizing: unable to tokenize: invalid char escape



This is the error I am getting : 

 

tokenizing: unable to tokenize: invalid char escape

It is recommended to use single quotes with re.regex 



re.regex($e.target.hostname, `\\$$`)

If you use double quotes you then need to escape your escape characters:


re.regex($e.target.hostname, "\\\\$$")


@cmmartin_google summed it up neatly above but I will share a blog I wrote on re.regex for future reference. I took a look at trying to use double quotes for something rather than the backtick, but the last 4 paragraphs hopefully provide a nice visual why going with backticks is going to be a better way forward...


https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Matching-with-Regular-Expression-Functions/ba-p/724857


 


Reply