topic How to replace string using rex with partial matched string? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658314#M227399 <P>How to replace string using rex with partial matched string?<BR />Thank you for your help.<BR />For example:<BR />I tried to replace "::" (double colon) with ":0:"&nbsp; (colon zero colon) if it the previous characters contain ":" followed by "1 to 3 characters"&nbsp;<BR />| rex mode=sed field=ip "s/:.{1,3}::/:.{1,3}:0:/g"&nbsp; &nbsp;=&gt; this does not work because it will literally replace it with<BR />":.{1,3}:0:"&nbsp; &nbsp;instead of retaining the matched strings<BR /><BR />Before<BR />a0:1<STRONG>::</STRONG>21<BR />b0:1c<STRONG>::</STRONG>21<BR />c0:a13<STRONG>::</STRONG>23<BR /><BR />After<BR />a0:1<STRONG>:0:</STRONG>21<BR />b0:11<STRONG>:0:</STRONG>21<BR />c0:111<STRONG>:0:</STRONG>23<BR /><BR /></P> Thu, 21 Sep 2023 15:33:46 GMT LearningGuy 2023-09-21T15:33:46Z How to replace string using rex with partial matched string? https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658314#M227399 <P>How to replace string using rex with partial matched string?<BR />Thank you for your help.<BR />For example:<BR />I tried to replace "::" (double colon) with ":0:"&nbsp; (colon zero colon) if it the previous characters contain ":" followed by "1 to 3 characters"&nbsp;<BR />| rex mode=sed field=ip "s/:.{1,3}::/:.{1,3}:0:/g"&nbsp; &nbsp;=&gt; this does not work because it will literally replace it with<BR />":.{1,3}:0:"&nbsp; &nbsp;instead of retaining the matched strings<BR /><BR />Before<BR />a0:1<STRONG>::</STRONG>21<BR />b0:1c<STRONG>::</STRONG>21<BR />c0:a13<STRONG>::</STRONG>23<BR /><BR />After<BR />a0:1<STRONG>:0:</STRONG>21<BR />b0:11<STRONG>:0:</STRONG>21<BR />c0:111<STRONG>:0:</STRONG>23<BR /><BR /></P> Thu, 21 Sep 2023 15:33:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658314#M227399 LearningGuy 2023-09-21T15:33:46Z Re: How to replace string using rex with partial matched string? https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658316#M227401 <P>Characters to be retained should be enclosed in a capture group and that group referenced in the replacement text.</P><LI-CODE lang="markup">| rex mode=sed field=ip "s/:(.{1,3})::/:\1:0:/g" </LI-CODE> Thu, 21 Sep 2023 15:58:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658316#M227401 richgalloway 2023-09-21T15:58:29Z Re: How to replace string using rex with partial matched string? https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658344#M227409 <P>It worked!!&nbsp; Thank you..&nbsp; &nbsp;&nbsp;</P> Thu, 21 Sep 2023 19:58:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-string-using-rex-with-partial-matched-string/m-p/658344#M227409 LearningGuy 2023-09-21T19:58:15Z