https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151055#M42325 <P>What is the Splunk query that is failing?</P> Mon, 15 Jun 2015 11:45:20 GMT richgalloway 2015-06-15T11:45:20Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151054#M42324 <P>Hi, I'm new to Splunk. I have a query that extracts the date and time from the name of a log file. Logfile names are like e.g. XXXXXXXX_20150615133030.log. My query successfully returns the desired output which is 20150615133030. This is as per my requirement.</P> <P>Now, i would like to edit the number to show like this -- "2015-06-15 13:30:30".<BR /> I tried the following command in bash prompt and it works -- <CODE>sed 's/^\(.\{4\}\)\(.\{2\}\)\(.\{2\}\)\(.\{2\}\)\(.\{2\}\)/\1-\2-\3 \4:\5:/g' numbers.txt</CODE> and it works fine. But this is not working when i use it in my Splunk query.</P> <P>Please answer if anyone knows. Thanks in advance.</P> Mon, 15 Jun 2015 11:32:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151054#M42324 nilotpaldutta 2015-06-15T11:32:02Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151055#M42325 <P>What is the Splunk query that is failing?</P> Mon, 15 Jun 2015 11:45:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151055#M42325 richgalloway 2015-06-15T11:45:20Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151056#M42326 <P>Also, why don't you edit your <STRONG>props.conf</STRONG> for it? I think it will be easy!</P> Mon, 15 Jun 2015 11:50:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151056#M42326 stephanefotso 2015-06-15T11:50:22Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151057#M42327 <P><CODE>index=myindex | dedup source | sort -source | dedup sourcetype | rex field=source mode=sed "s/[^0-9]*//g" | rename source as date | rex field=date mode=sed "s/(\d{4}-){1}/2015-/g" | table sourcetype, date</CODE></P> <P>source and sourcetype are two fields i'm retrieving.</P> Mon, 15 Jun 2015 12:04:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151057#M42327 nilotpaldutta 2015-06-15T12:04:51Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151058#M42328 <P>Thanks for your response. Can you please post an example?<BR /> I'm not looking to standardize my output. Just need it once for the above query. <BR /> I might be wrong but isn't editing any config file going to always return results of other queries also in one particular format?</P> Mon, 15 Jun 2015 12:18:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151058#M42328 nilotpaldutta 2015-06-15T12:18:48Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151059#M42329 <P>in the search query, the sed string is between double quotes. Therefore you have to escape or double escape some symbols.</P> <P>PS: in the props.conf you do not need the extra escape.</P> Mon, 15 Jun 2015 12:34:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151059#M42329 yannK 2015-06-15T12:34:28Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151060#M42330 <P>Your search is failing because the <CODE>date</CODE> field does not have a hyphen in it. This should work (your original sed string has far too many escapes).</P> <PRE><CODE>rex field=date mode=sed "s/(.{4})(.{2})(.{2})(.{2})(.{2})/\1-\2-\3 \4:\5:/" </CODE></PRE> Mon, 15 Jun 2015 12:51:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151060#M42330 richgalloway 2015-06-15T12:51:59Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151061#M42331 <P>Thank you. This works for me. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 16 Jun 2015 05:48:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151061#M42331 nilotpaldutta 2015-06-16T05:48:52Z https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151062#M42332 <P>Please accept the answer.</P> Tue, 16 Jun 2015 12:30:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-rex-and-sed-to-insert-and-in-the-result/m-p/151062#M42332 richgalloway 2015-06-16T12:30:15Z