Getting Data In

remove space and tab char between from ">" "<\"

jangid
Builder

I want to remove all the spaces in between ">" "<\" and want to use this in SEDCMD

Here is my regex but this is not working

SEDCMD-RemoveSpaceChar = s/">\s+<\\"/""/g
Tags (1)
0 Karma
1 Solution

Gilberto_Castil
Splunk Employee
Splunk Employee

If you are looking to remove whitespaces, the best approach is to focus on situations where you see more than one whitespace and remove. You can accomplish that with the following;

SEDCMD-remove-white-space = s/\s{2,}//g  

To test this during an in-line search, use this:

sourcetype=xml_blah blah blah | rex mode=sed "s/\s{2,}//g"

This will translate this:

<xml_property_document>

    <xml_property_outer xml_variable=variable value>

        <xml_property_inner>inner property value</xml_property_inner>

    </xml_property_outer>

</xml_property_document>

Into this:

<xml_property_document><xml_property_outer xml_variable=variable value><xml_property_inner>inner property value</xml_property_inner></xml_property_outer></xml_property_document>



I do not think the SEDCMD command will allow you to capture the "<" and ">" characters and not replace them.

BTW: The reason we opt for anything beyond a single white space is because XML may contain spaces in the presented values, as well is in tree-branch variables. After all, you do not want to remove all spaces; just the extra items that make it difficult for a human to read.

Good luck.

View solution in original post

Gilberto_Castil
Splunk Employee
Splunk Employee

If you are looking to remove whitespaces, the best approach is to focus on situations where you see more than one whitespace and remove. You can accomplish that with the following;

SEDCMD-remove-white-space = s/\s{2,}//g  

To test this during an in-line search, use this:

sourcetype=xml_blah blah blah | rex mode=sed "s/\s{2,}//g"

This will translate this:

<xml_property_document>

    <xml_property_outer xml_variable=variable value>

        <xml_property_inner>inner property value</xml_property_inner>

    </xml_property_outer>

</xml_property_document>

Into this:

<xml_property_document><xml_property_outer xml_variable=variable value><xml_property_inner>inner property value</xml_property_inner></xml_property_outer></xml_property_document>



I do not think the SEDCMD command will allow you to capture the "<" and ">" characters and not replace them.

BTW: The reason we opt for anything beyond a single white space is because XML may contain spaces in the presented values, as well is in tree-branch variables. After all, you do not want to remove all spaces; just the extra items that make it difficult for a human to read.

Good luck.

Ayn
Legend

So does the string you're matching against actually contain \" with backslash and everything?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...