<Update> <data> <user> <dialogs>/finesse/api/User/72741/Dialogs</dialogs> <extension></extension> <firstName>Bert</firstName> <lastName>Smith</lastName>
Trying to remove the spaces between > and <
I have tried the following - several of the patterns I have tried work fine on REgex testing sites but fail for use in Splunk
I started using ZZ just as a marker to see what effect the replace was having as using >< seems to fail in any use. I checked and the charaters >< are not regex special characters
| rex field=myraw mode=sed "s/(> <)/ZZ/g" - No effect
| rex field=myraw mode=sed "s/(\W \W)/ZZ/g" - inconsistent replaces
<notification><Update>ZZ<data>ZZZZuser>ZZZZ <dialogs>/finesse/api/User/72741/Dialogs</dialogs>ZZZZ <extension>511835</extension>ZZZZ <firstName>Bert</firstName>ZZZZ <lastName>Smith</lastName>ZZZZ
| rex field=myraw mode=sed "s/\x{3e} \x{3c}/ZZ/g" - no effect
Not sure now whether Splunk has issues with <> or what - its confusing that I can get this to work in several ways testing on regex sites.
Thanks
@Ttreb ,
Try
|rex field=your_field_name mode=sed "s/>\s+<//g"
@Ttreb ,
Try
|rex field=your_field_name mode=sed "s/>\s+<//g"
Thanks for the response that does the trick - was driving me batty trying to work out - just couldn't nail the right pattern.