https://community.splunk.com/t5/Getting-Data-In/sed-combined-help/m-p/99400#M20791 <P>Well, <CODE>sed</CODE> supports the <CODE>y</CODE> command (character substitution), but since there is not a 1-to-1 mapping, I don't think you can apply that here.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script</A></P> <P>However, you can put all of your regexes into <CODE>props.conf SEDCMD</CODE> statements, or through transforms, which would make the alteration permanent (may not be compatible with any requirements of keeping data in its original format, if you have such). </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_regex_transform">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_regex_transform</A></P> <P>Hope this helps,</P> <P>Kristian</P> Thu, 18 Apr 2013 15:07:13 GMT kristian_kolb 2013-04-18T15:07:13Z https://community.splunk.com/t5/Getting-Data-In/sed-combined-help/m-p/99399#M20790 <P>I am using the following to clean up output:</P> <P>rex mode=sed field=search_google2 "s/\%20/ /g";"s/\%5B/[/g" | rex mode=sed field=search_google2 "s/\%22/\"/g" | rex mode=sed field=search_google2 "s/\%5B/[/g" | rex mode=sed field=search_google2 "s/\%5D/]/g" | rex mode=sed field=search_google2 "s/\%2B/+/g" | rex mode=sed field=search_google2 "s/\%2C/,/g" | rex mode=sed field=search_google2 "s/\%3A/:/g" | rex mode=sed field=search_google2 "s/\%27/'/g" | rex mode=sed field=search_google2 "s/\%40/@/g" | rex mode=sed field=search_google2 "s/\%3B/;/g" | rex mode=sed field=search_google2 "s/\%25/%/g"</P> <P>I am new to regex.... can I combine the regex into one statement instead of the multiple pipes?</P> Mon, 28 Sep 2020 13:45:34 GMT https://community.splunk.com/t5/Getting-Data-In/sed-combined-help/m-p/99399#M20790 mcbradford 2020-09-28T13:45:34Z https://community.splunk.com/t5/Getting-Data-In/sed-combined-help/m-p/99400#M20791 <P>Well, <CODE>sed</CODE> supports the <CODE>y</CODE> command (character substitution), but since there is not a 1-to-1 mapping, I don't think you can apply that here.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script</A></P> <P>However, you can put all of your regexes into <CODE>props.conf SEDCMD</CODE> statements, or through transforms, which would make the alteration permanent (may not be compatible with any requirements of keeping data in its original format, if you have such). </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_regex_transform">http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_regex_transform</A></P> <P>Hope this helps,</P> <P>Kristian</P> Thu, 18 Apr 2013 15:07:13 GMT https://community.splunk.com/t5/Getting-Data-In/sed-combined-help/m-p/99400#M20791 kristian_kolb 2013-04-18T15:07:13Z