topic Re: Adding delimiter to a field values in Splunk Search

Adding delimiter to a field values

Laxman24 — Wed, 28 Oct 2020 08:13:28 GMT

Hi all,

I need some help in creating a new field,

I have a field like following

Field 1

AABBCCDDEEFF

AAAABBBBCCCC

Id like to make a new field and the values become :

AA-BB-CC-DD-EE-FF

AA-AA-BB-BB-CC-CC

could someone help me with this?

Thanks in advance!

Re: Adding delimiter to a field values

ITWhisperer — Wed, 28 Oct 2020 08:54:15 GMT

| rex mode=sed "s/(?<pair>\w{2})/\1-/g s/-$//g"

Re: Adding delimiter to a field values

Laxman24 — Wed, 28 Oct 2020 09:33:01 GMT

Thank you!!!! 🙂 it works

Re: Adding delimiter to a field values

ayushisrivastav — Thu, 02 Mar 2023 08:55:52 GMT

Hi @ITWhisperer ,

please can you explain me the regular expression which you have written to fulfil the request.

Re: Adding delimiter to a field values

ITWhisperer — Thu, 02 Mar 2023 09:10:16 GMT

Firstly, rex is put into stream-edit (sed) mode.

The regular expression is in two parts (separated by a space)

Secondly, the first sed expression means substitute (s) the captured group (?<pair>\w{2}) of 2 word-characters with the first captured group (\1) followed by a hyphen (1) done globally (g) through the field.

Thirdly, the second sed expression means substitute (s) the hyphen (-) at the end ($) for nothing i.e. remove it.