topic Replace field value using rex in Splunk Dev

Replace field value using rex

Nadhiyaa — Sun, 09 Sep 2018 06:25:22 GMT

XXXXXX y XXXXXX y

So this is my value of a field z . How to replace this with XXXXXX y.

Below is not working

rex mode=sed field=z "s/XXXXXX y XXXXXX y/XXXXXX y/g"

Re: Replace field value using rex

493669 — Sun, 09 Sep 2018 06:35:58 GMT

i tried this it seems to be working-

| makeresults |eval z="XXXXXX y XXXXXX y"|rex mode=sed field=z "s/XXXXXX y XXXXXX y/XXXXXX y/g"

what is expected output ..can you provide some details..

Re: Replace field value using rex

Nadhiyaa — Sun, 09 Sep 2018 08:51:37 GMT

when we do eval , it works .

when i do directly after the stats command ,it is not

Re: Replace field value using rex

jkat54 — Sun, 09 Sep 2018 12:10:07 GMT

Try this:

rex mode=sed field=z "s/(XXXXXX\s+y)\s+XXXXXX\s+y/\1/g"

the \s+ should grab tabs and whitespace. The parens () and \1 will make the first part of that string a capture group, and use what is captured as the replacement.