topic Re: Rex Field=All Fields mode=sed in Splunk Dev

Rex Field=All Fields mode=sed

tuanledang1120 — Tue, 05 Jul 2016 04:29:12 GMT

Hi,

I'm trying to do a sed (replacing comma with _) on all fields, instead of having to specify which field I want to do the sed command on. Is that possible?

I tried to do field=*, but that did not work.

Thanks.

Re: Rex Field=All Fields mode=sed

sundareshr — Tue, 05 Jul 2016 11:44:09 GMT

Try field=_raw OR you don't need to specify a field. You could just do rex mode=sed "your regex"

Re: Rex Field=All Fields mode=sed

javiergn — Tue, 05 Jul 2016 12:32:52 GMT

Alternatively you could use foreach:

| foreach * [eval <<FIELD>>=replace(<<FIELD>>, ",", "_" )]

Re: Rex Field=All Fields mode=sed

ddrillic — Tue, 05 Jul 2016 13:46:44 GMT

If you like, you can take it to props.conf.

We do the following to remove spaces -

# :"   kkkki    " -- remove spaces
SEDCMD-trim-ws1 = s/(:\")(\s+)?(\w+)(\s+)?(\")/\1\3\5/g

So, it's a sed command at the props.conf level.

In your case, the following should work -

SEDCMD-replace = s/,/_/g

Re: Rex Field=All Fields mode=sed

tuanledang1120 — Tue, 05 Jul 2016 17:41:30 GMT

I tried this but it didn't work.

Re: Rex Field=All Fields mode=sed

tuanledang1120 — Tue, 05 Jul 2016 17:50:39 GMT

This works! Thanks a lot!