topic Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command. in Getting Data In

I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

anjanikumar — Tue, 19 Jul 2016 07:38:55 GMT

First I tried to search for chars which aren't alphanumeric and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[^a-zA-Z0-9]/ /g"*

This does work fine but when I try the other approach as shown below

Second approach was to find all the special characters and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[!@#$%^&()-?/{}<|>\:;]/ /g"

This does display an error: Error in 'rex' command: Regex: missing terminating ] for character class

Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

sundareshr — Tue, 19 Jul 2016 12:54:46 GMT

Try escaping the special characters

... | rex mode=sed "s/\\[\!\@\#\$\%\^\&\(\)\-\?\/\{\}\<\|\>\\\\\:\;]/ /g""

Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

javiergn — Tue, 19 Jul 2016 13:26:30 GMT

For completion and in order to avoid complicated syntax I would use the following regex instead:

| rex mode=sed "s/\W+/ /g"

Or if you want to have a more granular control:

| rex mode=sed "s/[^a-zA-Z0-9_\-\.]+/ /g"

Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

neelamsantosh — Wed, 19 Apr 2017 09:54:59 GMT

how to use this during parsing time or props.conf

Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

javiergn — Wed, 19 Apr 2017 10:04:19 GMT

Take a look at the following http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Anonymizedata as it'll explain this better than me.

The concept is the same.

Re: I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

mad4wknds — Sat, 27 May 2017 18:37:26 GMT

I believe this link has the answer you are looking for.

https://answers.splunk.com/answers/139777/rex-mode-sed-diff-between-replace-and-substitute.html