<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic SEDCMD tab insert in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43951#M8210</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;Using the SEDCMD (props.conf), I want to replace a char string '#11' with a tab. However, when I use:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\t/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\\t/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\x09/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The char #011 is replaced by the literal string '\t', '\t', or '\x09' and not with the= tab character.  I've even tested this successfully using the sed -r equivalent on the CLI&lt;/P&gt;

&lt;P&gt;Any help is appreciated. Thanks&lt;/P&gt;</description>
    <pubDate>Fri, 24 Aug 2012 18:42:00 GMT</pubDate>
    <dc:creator>wsweat</dc:creator>
    <dc:date>2012-08-24T18:42:00Z</dc:date>
    <item>
      <title>SEDCMD tab insert</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43951#M8210</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;Using the SEDCMD (props.conf), I want to replace a char string '#11' with a tab. However, when I use:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\t/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\\t/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/\x09/g
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The char #011 is replaced by the literal string '\t', '\t', or '\x09' and not with the= tab character.  I've even tested this successfully using the sed -r equivalent on the CLI&lt;/P&gt;

&lt;P&gt;Any help is appreciated. Thanks&lt;/P&gt;</description>
      <pubDate>Fri, 24 Aug 2012 18:42:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43951#M8210</guid>
      <dc:creator>wsweat</dc:creator>
      <dc:date>2012-08-24T18:42:00Z</dc:date>
    </item>
    <item>
      <title>Re: SEDCMD tab insert</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43952#M8211</link>
      <description>&lt;P&gt;This should work: &lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;SEDCMD-fix_tab = s/#011/ /g&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;The space before the "/g" is an actual/literal tab. (ie., hit TAB button on your keyboard)&lt;/P&gt;

&lt;P&gt;Hope this helps, &lt;/P&gt;

&lt;P&gt;d.&lt;/P&gt;</description>
      <pubDate>Sat, 25 Aug 2012 15:59:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43952#M8211</guid>
      <dc:creator>_d_</dc:creator>
      <dc:date>2012-08-25T15:59:20Z</dc:date>
    </item>
    <item>
      <title>Re: SEDCMD tab insert</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43953#M8212</link>
      <description>&lt;P&gt;Thanks, that's what I decided to do and it seemed to work. It just looked odd as I'm used to using character sequences, like '\t', to indicate a tab; and the assumption that this field would be regex (pcre) compliant as well.&lt;/P&gt;</description>
      <pubDate>Sat, 25 Aug 2012 18:08:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43953#M8212</guid>
      <dc:creator>wsweat</dc:creator>
      <dc:date>2012-08-25T18:08:47Z</dc:date>
    </item>
    <item>
      <title>Re: SEDCMD tab insert</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43954#M8213</link>
      <description>&lt;P&gt;Glad that you made it work. Also, note that the replaced field is not a regex. The correct syntax is: &lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;s/regex/replacement/flags&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 25 Aug 2012 18:52:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/SEDCMD-tab-insert/m-p/43954#M8213</guid>
      <dc:creator>_d_</dc:creator>
      <dc:date>2012-08-25T18:52:41Z</dc:date>
    </item>
  </channel>
</rss>

