https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196952#M56864 <P>about using eval?</P> <P>･･･|eval Month=if(len(Month)==6,"0"+Month,Month)</P> Thu, 12 Jun 2014 09:40:58 GMT HiroshiSatoh 2014-06-12T09:40:58Z https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196951#M56863 <P>Hello Guys ,</P> <P>I have a field Month that have values like this</P> <P>1-2013<BR /> 10-2014<BR /> 9-2014</P> <P>i would like to get 0X-YYYY if month &lt;10</P> <P>so 1-2013 becomes 01-2013<BR /> 10-2014 stays 10-2014<BR /> 9-2014 becomes 09-2014</P> <P>I've tried rex mode=sed field="Month" "s/(^[0-9]-.*)/0\1/" (it works fine on linux but not on Splunk ..)</P> <P>Could you help me ?</P> <P>Thanks !</P> Thu, 12 Jun 2014 08:59:51 GMT https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196951#M56863 baranova 2014-06-12T08:59:51Z https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196952#M56864 <P>about using eval?</P> <P>･･･|eval Month=if(len(Month)==6,"0"+Month,Month)</P> Thu, 12 Jun 2014 09:40:58 GMT https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196952#M56864 HiroshiSatoh 2014-06-12T09:40:58Z https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196953#M56865 <P>I'm not familiar with sed mode, but have you tried escaping the square brackets with a backslash. Whenever a regex fails to match the expected results my first thought is always escaping special characters. Some regex modes assume special meaning unless expressly suppressed whilst others are the reverse, and just for fun some assume special meaning for one subset whilst not for others. It can be mind-bendingly confusing.</P> Thu, 12 Jun 2014 09:41:07 GMT https://community.splunk.com/t5/Splunk-Search/Replace-A-pattern-Splunk/m-p/196953#M56865 grijhwani 2014-06-12T09:41:07Z