Splunk Search

Replace string

john
Communicator

I want to replace (" ") in my xml file to single (").Since there is some misplace of double codes in my whole file.So please help
<?xml version=""1.0"" encoding=""ISO-9000-1"" ?>

Tags (1)

gooza
Communicator

try:

yoursearch | rex mode=sed "s/\"\"/\"/g"

john
Communicator

Thanks gooza.its working

0 Karma

kjamsheed
New Member

works for me as well

0 Karma

Michael
Contributor

I had to add the field name to make mine work:
(replacing + with a space in my case)

rex mode=sed field=search_term_used "s/+/ /g"

Also, in my case I had to escape the +

weird, when I post this comment, the rex line looses the escape character .

0 Karma

Livia
Engager

Have you tried to open the xml file with an editor, most of them have a find an replace function.

0 Karma

john
Communicator

I should not replace any values manually in the file.I meant i want to replace that double codes during time of search only since it should not make any permanent change in xml file.Can u suggest any search query for that

0 Karma

meenal901
Communicator

You can try replace function of eval for a single field

eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")

Else rex will solve your problem 100%

rex mode=sed "s/\"\"/\"/g"

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...