topic having a doubt in splunk query in Splunk Search

having a doubt in splunk query

Chandrasekhar6 — Tue, 28 Nov 2023 06:17:52 GMT

I want to change the msg for a log i.e

<list >
<Header>.....</Header>
<status>
<Message>Thuihhh_4y3y27y234yy4 is pending</Message>
</status>
</list>

to

<list >
<Header>.....</Header>
<status>
<Message>request is pending</Message>
</status>
</list>

how can i achieve using rex+sed commands in splunk

Re: having a doubt in splunk query

bowesmana — Tue, 28 Nov 2023 07:52:07 GMT

Try this

| rex mode=sed "s/(<Message>).*( is pending)(<\/Message>)/\1request\2\3/"

Re: having a doubt in splunk query

PickleRick — Tue, 28 Nov 2023 12:46:59 GMT

While @bowesmana 's solution should work be aware that working with structured data using just regexes can lead to unforeseen problems.