topic Re: What should I use to put a TAB literally in a regex replacement within transforms.conf? in Splunk Search

What should I use to put a TAB literally in a regex replacement within transforms.conf?

stefan1988 — Mon, 22 May 2017 12:55:34 GMT

What should I use to put a TAB literally in a regex replacement within transforms.conf?

I've tried \t but that's not working.

I would like to replace a | with tab (ASCI 0x09)

Re: What should I use to put a TAB literally in a regex replacement within transforms.conf?

gcusello — Mon, 22 May 2017 13:00:00 GMT

Hi stefan1988,
are you sure that it's a TAB and not spaces?
Bye.
Giuseppe

Re: What should I use to put a TAB literally in a regex replacement within transforms.conf?

stefan1988 — Mon, 22 May 2017 13:04:15 GMT

Hi,

Yes I want to place a tab (ASCII 0x09).
\t seems not working.

Regards,
Stefan

Re: What should I use to put a TAB literally in a regex replacement within transforms.conf?

woodcock — Mon, 22 May 2017 16:58:05 GMT

I cannot get escape codes (other than for captured field references) to work in the replace portion of sed inside of Splunk so I do not thing that this is possible without pre-processing with your own "glue" before coming into Splunk. I tried using \t and also \x09 and neither works.

Re: What should I use to put a TAB literally in a regex replacement within transforms.conf?

malvidin — Tue, 21 Jul 2020 10:32:19 GMT

For me, the only backslash sequences that worked for sed replacement were the newline (\n) and back references (\1, \2, etc.).

I think I'm going to have to put the replacement into an external lookup/command to include the ability to use other characters, like \r, \x0D, \t, or \x09.