topic Re: Regex ignore adding underscore if there is a dash in Splunk Search

Regex ignore adding underscore if there is a dash

mcarthurnick — Wed, 30 Sep 2020 00:11:55 GMT

Hey everyone. So what I need to do is complete the filename in one of my fields in an event. Example is this:

attachment = Filename ABC - 2019 111 CT.pdf

I am using the command: | rex mode=sed field=attachment "s/ /_/g" to replace the whitespace with underscores.

Question: How do I go about ignoring the whitespace before and after the dash. I am getting Filename_ABC_- _2019_111_CT.pdf when it needs to be Filename_ABC-2019_111_CT.pdf

Any help would be great. Thank you!

Re: Regex ignore adding underscore if there is a dash

saurabhkharkar — Thu, 18 Apr 2019 17:51:24 GMT

Try this

| makeresults
| eval attachment="Filename ABC - 2019 111 CT.pdf"
| rex mode=sed field=attachment "s/\s-\s/-/g"
| rex mode=sed field=attachment "s/\s/_/g" 
| table attachment

Re: Regex ignore adding underscore if there is a dash

mayurr98 — Thu, 18 Apr 2019 18:04:05 GMT

Try this :

| makeresults 
| eval attachment="Filename ABC - 2019 111 CT.pdf" 
| eval attachment=replace(attachment,"\s-\s","-"),attachment=replace(attachment,"\s","_")

let me know if this helps!

Re: Regex ignore adding underscore if there is a dash

mcarthurnick — Thu, 18 Apr 2019 18:14:43 GMT

This seemed to work for me. Thanks!

Can you explain to me how that works in some detail? Thank you.

Re: Regex ignore adding underscore if there is a dash

mayurr98 — Thu, 18 Apr 2019 18:21:30 GMT

Well, it's pretty simple,

replace is a text function of eval command. It has 3 arguments say, X, Y, Z. This function returns a string formed by substituting string Z for every occurrence of regex string Y in field value X.

Find a detailed explanation here:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/TextFunctions#replace.28X.2CY.2CZ.29

Re: Regex ignore adding underscore if there is a dash

mcarthurnick — Fri, 19 Apr 2019 13:50:11 GMT

Greatly Appreciated! Thank you.