topic Replace string in Splunk Search

Replace string

john — Thu, 15 Mar 2012 11:31:44 GMT

I want to replace (" ") in my xml file to single (").Since there is some misplace of double codes in my whole file.So please help
<?xml version=""1.0"" encoding=""ISO-9000-1"" ?>

Re: Replace string

Livia — Thu, 15 Mar 2012 12:17:10 GMT

Have you tried to open the xml file with an editor, most of them have a find an replace function.

Re: Replace string

john — Fri, 16 Mar 2012 06:43:38 GMT

I should not replace any values manually in the file.I meant i want to replace that double codes during time of search only since it should not make any permanent change in xml file.Can u suggest any search query for that

Re: Replace string

gooza — Fri, 16 Mar 2012 06:57:25 GMT

try:

yoursearch | rex mode=sed "s/\"\"/\"/g"

Re: Replace string

john — Fri, 16 Mar 2012 08:39:08 GMT

Thanks gooza.its working

Re: Replace string

Michael — Mon, 28 Sep 2020 18:37:54 GMT

I had to add the field name to make mine work:
(replacing + with a space in my case)

rex mode=sed field=search_term_used "s/+/ /g"

Also, in my case I had to escape the +

weird, when I post this comment, the rex line looses the escape character .

Re: Replace string

kjamsheed — Fri, 08 Apr 2016 13:41:06 GMT

works for me as well

Re: Replace string

meenal901 — Fri, 08 Apr 2016 14:14:33 GMT

You can try replace function of eval for a single field

eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")

Else rex will solve your problem 100%

rex mode=sed "s/\"\"/\"/g"