topic Re: How to do 2 parameters rex mode=sed ? in Splunk Search

How to do 2 parameters rex mode=sed ?

pgbr7 — Sat, 08 Oct 2016 16:40:51 GMT

Hello Guys,

It's possible 2 parameters rex mode=sed in sequence ?
I can change ab for 01 and ac for 02

I try this, but not work:
| rex mode=sed field=_raw "s/ab/01/g;s/ac/02/g"
Error:
Error in 'rex' command: Failed to initialize sed. Invalid option string: g;s/ac/02/g

or i need to use 2 rex mode=sed field=_raw , 1 for change ab for 01and other for change ac for 02 ?

Re: How to do 2 parameters rex mode=sed ?

richgalloway — Sat, 08 Oct 2016 20:02:01 GMT

Use two rex commands.

Re: How to do 2 parameters rex mode=sed ?

pgbr7 — Sat, 08 Oct 2016 22:32:13 GMT

This is not good, because if I need to change 3 or more its very dificult.

Thanks

Re: How to do 2 parameters rex mode=sed ?

gokadroid — Sat, 08 Oct 2016 22:54:59 GMT

Use the rex mode sed command split over two lines rather than writing the code in one single line. Also do not use the ; in between. So basically whatever you were trying to achieve with semicolon in between, achieve it with in same command but split over two lines:

yourBaseSearch
| rex mode=sed field=_raw "s/ab/01/g
s/ac/02/g"
| stats count by yourField

NOTE: I have removed the semicolon and tricked command to be in multiline

Re: How to do 2 parameters rex mode=sed ?

pgbr7 — Sun, 09 Oct 2016 02:44:05 GMT

Thanks It's working !

Re: How to do 2 parameters rex mode=sed ?

redflexigork — Sun, 10 Sep 2017 23:17:37 GMT

Also noticed it works with the space:

| rex mode=sed field=_raw "s/ab/01/g s/ac/02/g"