topic Re: rex in sed mode to replace special chartacter in Splunk Search

rex in sed mode to replace special chartacter

ChrisCLewis — Tue, 17 Sep 2019 10:16:00 GMT

Good morning
I need to replace special characters with a line return command but I am having difficulty getting the rex mode=sed working correctly -

example foo fields

hr$D362$processing
long$trip

| rex field=foo mode=sed "s/(".+?$.+?")/\n/g"

Many thanks for any help you could provide

Re: rex in sed mode to replace special chartacter

kamlesh_vaghela — Tue, 17 Sep 2019 11:59:20 GMT

@ChrisCLewis

Can you please try this rex command?
| rex field=foo mode=sed "s/\$/\n/g"

Sample Search:

| makeresults | eval foo="hr$D362$processing" | rex field=foo mode=sed "s/\$/\n/g"

Re: rex in sed mode to replace special chartacter

ChrisCLewis — Tue, 17 Sep 2019 12:24:23 GMT

Good afternoon,

thank you for your reply.

It is changing the $ to a space rather than a line return
showing
hr D362 processing

hoping for:
hr
D362
processing

Regards

Re: rex in sed mode to replace special chartacter

kamlesh_vaghela — Tue, 17 Sep 2019 12:52:26 GMT

It's working for me. Please check. https://imgur.com/a/q0w7ZjL

Can you please share your full search with masking confidential values?

Re: rex in sed mode to replace special chartacter

ChrisCLewis — Tue, 17 Sep 2019 13:52:36 GMT

index=foobar
|eval s1= section.";".Name.";".Code
|eval s2=crit.";".critname

|stats values(Number) as Number by s2 s1
| rex field=s2 mode=sed "s/\;/\n/g"
| rex field=s1 mode=sed "s/\;/\n/g"
|chart values(Number) over sepa2 by sepa useother=f usenull=f

Interestingly when I 'inspect' the graph it looks like there is a line break but splunk is showing it as a space in the chart

Re: rex in sed mode to replace special chartacter

to4kawa — Sun, 19 Jan 2020 10:54:19 GMT

| makeresults
| eval _raw="hr$D362$processing"
| appendpipe
    [eval _raw="long$trip"]
    | eval foo=split(_raw,"$")

Hi, folks.
Simply, use split()

Re: rex in sed mode to replace special chartacter

to4kawa — Sun, 19 Jan 2020 11:01:47 GMT

index=foobar 
| eval s1= section.";".Name.";".Code 
| eval s2=crit.";".critname 
| stats values(Number) as Number by s2 s1 
| eval s2 = split(s2,";"), s1 = split(s1,";") 
| chart values(Number) as Number over s2 by s1 useother=f usenull=f

Here is for search query.
I see the multiple values are automatically expanded.
great!