https://community.splunk.com/t5/Splunk-Search/SEDCMD-to-filter-the-character-between-the-user/m-p/350238#M161279 <P>Curently our proxy logs with user having special characters inbetween.<BR /> ref: DC=local/bob\, tom</P> <P>I have created a props.conf with<BR /> SEDCMD-alter_user= s/\\,//g<BR /> with which i am able to get the desired value but its too generic.<BR /> ref: DC=local/bob tom<BR /> Kindly assist me with the SEDCMD <BR /> SEDCMD-alter_user= s/"local/"\\,//g</P> Tue, 29 Sep 2020 13:50:30 GMT neelamsantosh 2020-09-29T13:50:30Z https://community.splunk.com/t5/Splunk-Search/SEDCMD-to-filter-the-character-between-the-user/m-p/350238#M161279 <P>Curently our proxy logs with user having special characters inbetween.<BR /> ref: DC=local/bob\, tom</P> <P>I have created a props.conf with<BR /> SEDCMD-alter_user= s/\\,//g<BR /> with which i am able to get the desired value but its too generic.<BR /> ref: DC=local/bob tom<BR /> Kindly assist me with the SEDCMD <BR /> SEDCMD-alter_user= s/"local/"\\,//g</P> Tue, 29 Sep 2020 13:50:30 GMT https://community.splunk.com/t5/Splunk-Search/SEDCMD-to-filter-the-character-between-the-user/m-p/350238#M161279 neelamsantosh 2020-09-29T13:50:30Z https://community.splunk.com/t5/Splunk-Search/SEDCMD-to-filter-the-character-between-the-user/m-p/350239#M161280 <P>This should be closer to what you need:</P> <PRE><CODE>SEDCMD-alter_user= s/local\/(\w+)\\,/\1/g </CODE></PRE> <P>You may need to tweak it for the characters that can be in your username (e.g. [-a-zA-Z0-9_]+ instead of \w+). You must escape the slash, not use double quotes the way you did, and pass the username through (\1)</P> <P><STRONG>I have edited this answer.</STRONG></P> Wed, 26 Apr 2017 13:39:12 GMT https://community.splunk.com/t5/Splunk-Search/SEDCMD-to-filter-the-character-between-the-user/m-p/350239#M161280 cpetterborg 2017-04-26T13:39:12Z