Splunk Search

SEDCMD: How to change the format of my data collection?

khyoung7410
Communicator

Hi

The format of my data collection is as follows.

There are a total of 29 letters and numbers.

* Sample data
D0064659949080052811436122722

Can I replace the 13th to 25th digit with a space in these data?

This is the type of data I want:

<pre>D00646599490             2722</pre>

Thank you

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

View solution in original post

0 Karma

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...