topic Re: how to replace using SED command ? in Splunk Search

how to replace using SED command ?

m7787580 — Mon, 19 Jun 2017 16:31:39 GMT

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

horsefez — Mon, 19 Jun 2017 16:51:32 GMT

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

horsefez — Mon, 19 Jun 2017 16:52:49 GMT

you can display html codes by clicking the 101010 button and entering your text there

horsefez — Mon, 19 Jun 2017 16:54:26 GMT

you can substitute the _raw field with whatever field you use

m7787580 — Tue, 20 Jun 2017 08:40:14 GMT

Thanks a lot

m7787580 — Tue, 20 Jun 2017 09:17:14 GMT

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

horsefez — Tue, 20 Jun 2017 09:24:05 GMT

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.

m7787580 — Tue, 20 Jun 2017 09:31:01 GMT

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂