Problem with removing spaces using sed - with <> characters present

Ttreb — Mon, 18 Nov 2019 03:19:43 GMT

<Update> <data> <user> <dialogs>/finesse/api/User/72741/Dialogs</dialogs> <extension></extension> <firstName>Bert</firstName> <lastName>Smith</lastName>

Trying to remove the spaces between > and <

I have tried the following - several of the patterns I have tried work fine on REgex testing sites but fail for use in Splunk

I started using ZZ just as a marker to see what effect the replace was having as using >< seems to fail in any use. I checked and the charaters >< are not regex special characters

| rex field=myraw mode=sed "s/(> <)/ZZ/g" - No effect

| rex field=myraw mode=sed "s/(\W \W)/ZZ/g" - inconsistent replaces

<notification><Update>ZZ<data>ZZZZuser>ZZZZ <dialogs>/finesse/api/User/72741/Dialogs</dialogs>ZZZZ <extension>511835</extension>ZZZZ <firstName>Bert</firstName>ZZZZ <lastName>Smith</lastName>ZZZZ

| rex field=myraw mode=sed "s/\x{3e} \x{3c}/ZZ/g" - no effect

Not sure now whether Splunk has issues with <> or what - its confusing that I can get this to work in several ways testing on regex sites.

Thanks

Re: Problem with removing spaces using sed - with <> characters present

renjith_nair — Mon, 18 Nov 2019 04:54:56 GMT

@Ttreb ,

Try

|rex field=your_field_name mode=sed "s/>\s+<//g"

Re: Problem with removing spaces using sed - with <> characters present

Ttreb — Mon, 18 Nov 2019 05:04:46 GMT

Thanks for the response that does the trick - was driving me batty trying to work out - just couldn't nail the right pattern.

topic Re: Problem with removing spaces using sed - with <> characters present in Getting Data In

Problem with removing spaces using sed - with <> characters present

Re: Problem with removing spaces using sed - with <> characters present

Re: Problem with removing spaces using sed - with <> characters present