topic Regex to insert ":" after every second character in Splunk Search

Regex to insert ":" after every second character

coenvandijk — Sat, 12 Aug 2017 13:18:37 GMT

Hello

I have a string of all uppercase letters (no digits) I need a regex to insert a ":" after every second character FAGHIJGN becomes FA:GH:IJ:GN How can I do this with a regex?

Thanks in advance,
Coen

Re: Regex to insert ":" after every second character

jkat54 — Sat, 12 Aug 2017 23:13:28 GMT

If with search:

| rex mode=sed "s/(\w{2})(?=\w{1,2})/\1:/g"

If with props:

 SEDCMD-aaa = s/(\w{2})(?=\w{1,2})/\1:/g

These work too:

| rex mode=sed "s/(\w{2})(?=\w+)/\1:/g"

SEDCMD-aaa = s/(\w{2})(?=\w+)/\1:/g

Re: Regex to insert ":" after every second character

woodcock — Sun, 13 Aug 2017 03:31:48 GMT

Like this:

... | rex field=YourFieldNameHere mode=sed "s/(.{2})/\1:/g s/:$//"

Re: Regex to insert ":" after every second character

DalJeanis — Sun, 13 Aug 2017 20:21:54 GMT

@jkat54 - As coded, wouldn't that be limited to even numbers of pairs? I think you want that second \w{2} to be a positive lookahead, and only add the colon after \1.

  | rex mode=sed "s/(\w{2})(?=\w{2})/\1:/g"

Re: Regex to insert ":" after every second character

DalJeanis — Sun, 13 Aug 2017 20:36:00 GMT

@woodcock - Holy crud, sed mode allows multiple replacements in a single call?

That would simplify the ... presentation, lets say... of my more complicated uses of the format command.

I have a NEW TOY!

See why I keep you guys around?

Re: Regex to insert ":" after every second character

jkat54 — Sun, 13 Aug 2017 20:57:09 GMT

Worked on regex101.com with even or odd numbers of letters.

Re: Regex to insert ":" after every second character

jkat54 — Sun, 13 Aug 2017 21:02:31 GMT

Ah I was able to break it... and fix it

Your approach is better but doesn't work with 5,7,etc

This does:

(\w{2})(?=\w{1,2})

Updating my answer

Re: Regex to insert ":" after every second character

woodcock — Sun, 13 Aug 2017 21:20:21 GMT

Ask anybody, I am full of IT.

Re: Regex to insert ":" after every second character

DalJeanis — Mon, 14 Aug 2017 03:21:35 GMT

@jkat54 - good point, but you can kill the {1,2} as redundant, since it's a zero length assertion so {1} is enough.