topic How to edit my rex command to replace a string? in Splunk Search

How to edit my rex command to replace a string?

chintan_shah — Thu, 11 May 2017 20:18:12 GMT

Hi,
I want to replace the string "\x00" with spaces.
"CP REQUESTED \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" and i tried below commands but it didn't work.

rex mode=sed field=EXCP_MSG "s/\\x00/ /g"
replace \\x00 WITH " " IN EXCP_MSG|stats count  by EXCP_MSG

Can anyone help me and also which command is better to use?

Re: How to edit my rex command to replace a string?

woodcock — Thu, 11 May 2017 20:47:32 GMT

The first rule of RegEx and backslashes: if at first you don't succeed, add another backslash:

| makeresults 
| eval EXCP_MSG="CP REQUESTED \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 

| rename COMMENT AS "Everything above fakes sample data; everything below is your solution"

| rex mode=sed field=EXCP_MSG "s/\\\\x00/ /g"

Re: How to edit my rex command to replace a string?

chintan_shah — Thu, 11 May 2017 21:11:07 GMT

Thanks Woodcock