topic Re: How do I reverse/swap characters in a string value returned from a search? in Splunk Search

How do I reverse/swap characters in a string value returned from a search?

ajay_mk — Fri, 11 Sep 2015 18:31:50 GMT

Hi,

If my search returns a string value of "ABCDEF"

1) How do I modify the search to reverse this value so it outputs "FEDCBA" ?

2) How do I swap characters from this value so it outputs "BADCFE" ? (1st 2 characters are being swapped)

Thanks!

Re: How do I reverse/swap characters in a string value returned from a search?

woodcock — Fri, 11 Sep 2015 19:36:10 GMT

This does just the first 2:

... | rex field=myField mode=sed "s/(.)(.)/\2\1/" | table host

Extend the example (more (.) in the first section and more \# in the second section) to reverse longer strings.

This byteswaps an entire string of any length (every pair):

... | rex field=myField mode=sed "s/(.)(.)/\2\1/g" | table host

Re: How do I reverse/swap characters in a string value returned from a search?

somesoni2 — Fri, 11 Sep 2015 19:52:47 GMT

I would suggest one correction to add "g" flag in the end to do it for all characters. like s/(.)(.)/\2\1/g

Re: How do I reverse/swap characters in a string value returned from a search?

ajay_mk — Fri, 11 Sep 2015 19:57:09 GMT

Hey thanks I just ran what you mentioned but its only swapping the first 2 characters.

Value to swap = 535276

Swapped value 355276

Changing the lengths doesnt seem to work?

Re: How do I reverse/swap characters in a string value returned from a search?

ajay_mk — Fri, 11 Sep 2015 19:58:10 GMT

ha perfect that worked. thank you both!

Re: How do I reverse/swap characters in a string value returned from a search?

somesoni2 — Fri, 11 Sep 2015 20:27:36 GMT

Don't forget to accept the answer by clicking on the Accept hyperlink below the answer.

Re: How do I reverse/swap characters in a string value returned from a search?

somesoni2 — Fri, 11 Sep 2015 21:43:33 GMT

Did you add the 'g' in the end as mentioed in the comment? Try this runanywhere sample search

| gentimes start=-1 | eval myField="535276" |  rex field=myField mode=sed "s/(.)(.)/\2\1/g"

Re: How do I reverse/swap characters in a string value returned from a search?

ajay_mk — Fri, 11 Sep 2015 21:44:57 GMT

yes the g worked thanks again.

Re: How do I reverse/swap characters in a string value returned from a search?

MuS — Sat, 12 Sep 2015 08:58:05 GMT

Sorry guys, but this is one of the sweetest regex ever on answers! 🙂

Re: How do I reverse/swap characters in a string value returned from a search?

woodcock — Wed, 16 Sep 2015 17:50:23 GMT

OK @MuS, cough up some up-vote love!

Re: How do I reverse/swap characters in a string value returned from a search?

wrangler2x — Fri, 06 Nov 2015 22:00:26 GMT

Reverse that string:

| gentimes start=-1| eval forward="ABCDEF" | eval reverse=replace(forward,"(.)(.)(.)(.)(.)(.)","\6\5\4\3\2\1")| table forward reverse

Reverse the first two characters only:

| gentimes start=-1| eval forward="ABCDEF" | eval reverse2=replace(forward,"(.)(.)","\2\1")| table forward reverse2

Re: How do I reverse/swap characters in a string value returned from a search?

wrangler2x — Fri, 06 Nov 2015 22:02:49 GMT

Think of | gentimes start=-1 as your search. This just allows the demonstration of this function, but any search can replace that part. And -- of course, the | eval forward="ABCDEF" is just the setup to give us a string to work with. In a real search that would be omitted, and forward could be any field with a string in it. 🙂

Re: How do I reverse/swap characters in a string value returned from a search?

jhuysing — Mon, 22 Jul 2019 22:52:23 GMT

This solution works for a fixed length string. Is there way of performing character reversal for variable length fields apart from have multiple regex's with different search and replacments lengths

|rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\10\9\8\7\6\5\4\3\2\1/"
| rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\9\8\7\6\5\4\3\2\1/"
| rex field=nbr mode=sed "s/(\d).(\d).(\d).(\d).(\d).(\d).(\d).(\d)/\8\7\6\5\4\3\2\1/"

Re: How do I reverse/swap characters in a string value returned from a search?

woodcock — Tue, 23 Jul 2019 13:46:56 GMT

Post a new question.