https://community.splunk.com/t5/Getting-Data-In/Drawing-a-blank-here-how-can-I-do-this-one-line/m-p/300446#M56810 <P>All, </P> <P>I know there is a better way to do this, drawing a complete blank. How do I do this in one line? Mind you I don't want to grab any other instances of method=*</P> <P>SEDCMD-log4jwild_method_post = s/method=POST/http_method=POST/g<BR /> SEDCMD-log4jwild_method_get = s/method=GET/http_method=GET/g<BR /> SEDCMD-log4jwild_method_options = s/method=OPTIONS/http_method=OPTIONS/g</P> Tue, 29 Sep 2020 18:08:49 GMT daniel333 2020-09-29T18:08:49Z https://community.splunk.com/t5/Getting-Data-In/Drawing-a-blank-here-how-can-I-do-this-one-line/m-p/300446#M56810 <P>All, </P> <P>I know there is a better way to do this, drawing a complete blank. How do I do this in one line? Mind you I don't want to grab any other instances of method=*</P> <P>SEDCMD-log4jwild_method_post = s/method=POST/http_method=POST/g<BR /> SEDCMD-log4jwild_method_get = s/method=GET/http_method=GET/g<BR /> SEDCMD-log4jwild_method_options = s/method=OPTIONS/http_method=OPTIONS/g</P> Tue, 29 Sep 2020 18:08:49 GMT https://community.splunk.com/t5/Getting-Data-In/Drawing-a-blank-here-how-can-I-do-this-one-line/m-p/300446#M56810 daniel333 2020-09-29T18:08:49Z https://community.splunk.com/t5/Getting-Data-In/Drawing-a-blank-here-how-can-I-do-this-one-line/m-p/300447#M56811 <P>How about this?</P> <PRE><CODE>SEDCMD-log4jwild = s/method=(POST|GET|OPTIONS)/http_method=\1/g </CODE></PRE> Tue, 20 Feb 2018 22:08:08 GMT https://community.splunk.com/t5/Getting-Data-In/Drawing-a-blank-here-how-can-I-do-this-one-line/m-p/300447#M56811 somesoni2 2018-02-20T22:08:08Z