topic What is the regular expression to replace a dash '-' in a string with a period '.' in Splunk Search

What is the regular expression to replace a dash '-' in a string with a period '.'

shivac — Tue, 07 Feb 2017 20:55:16 GMT

12-000-000-222

for the above IP address, i want to change it to 12.000.000.222. pls help.

Re: What is the regular expression to replace a dash '-' in a string with a period '.'

cpetterborg — Tue, 07 Feb 2017 21:24:03 GMT

the sedcmd syntax is:

s/-/./g

Will that work for you?

Re: What is the regular expression to replace a dash '-' in a string with a period '.'

vasanthmss — Tue, 07 Feb 2017 21:27:29 GMT

Try this,

your base search .. | rex mode=sed field=<your_field> "s/-/./g"

Sample:

|stats c | eval field="12-000-000-222" | table field | rex mode=sed field=field "s/-/./g"

Re: What is the regular expression to replace a dash '-' in a string with a period '.'

somesoni2 — Tue, 07 Feb 2017 21:41:02 GMT

FYI, Options, other than sed are,

....| eval YourIPField=replace(YourIPField,"-",".")

not so good method

...| replace"*-*-*-*" with "*.*.*.*" in YourIPField

Re: What is the regular expression to replace a dash '-' in a string with a period '.'

aaraneta_splunk — Sat, 11 Mar 2017 17:32:06 GMT

@shivac - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!