Splunk Search

how to replace using SED command ?

m7787580
Explorer

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

Tags (3)
1 Solution

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

View solution in original post

horsefez
Motivator

you can display html codes by clicking the 101010 button and entering your text there

0 Karma

horsefez
Motivator

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.
alt text

0 Karma

m7787580
Explorer

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂

0 Karma

m7787580
Explorer

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

0 Karma

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

horsefez
Motivator

you can substitute the _raw field with whatever field you use

0 Karma

m7787580
Explorer

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...