Splunk Search

SEDCMD: How to change the format of my data collection?

khyoung7410
Communicator

Hi

The format of my data collection is as follows.

There are a total of 29 letters and numbers.

* Sample data
D0064659949080052811436122722

Can I replace the 13th to 25th digit with a space in these data?

This is the type of data I want:

<pre>D00646599490             2722</pre>

Thank you

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

View solution in original post

0 Karma

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...