topic Re: how to add Attributes with a Regular Expression in Splunk Search

how to add Attributes with a Regular Expression

bigbeetlefan — Thu, 13 Mar 2014 00:42:49 GMT

Hi Gurus,

I have a index, and the data was in one column is like

Item__bAffected, I'd like to replace "__b" with a " "(space), so it will look like

"Item Affected"

however, I don't know how to used regular expression to replace the string, or its more easier to filter them out before input in to index?

any idea?

THanK you.

Re: how to add Attributes with a Regular Expression

MuS — Thu, 13 Mar 2014 13:48:55 GMT

Hi bigbeetlefan,

you can do this with rex like this:

... | rex mode=sed field=YourField "s/__b/ /g" | ...

cheers, MuS

Re: how to add Attributes with a Regular Expression

bigbeetlefan — Thu, 13 Mar 2014 20:18:42 GMT

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

Re: how to add Attributes with a Regular Expression

bigbeetlefan — Thu, 13 Mar 2014 20:25:34 GMT

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

Cheers

Re: how to add Attributes with a Regular Expression

somesoni2 — Thu, 13 Mar 2014 20:50:26 GMT

The rex command does the replacement at search time only (its not a permanent change to data stored). You need to include the rex part in each of the query your use for your chart/table etc.