All Apps and Add-ons

In my IIS logs, i have the client name 'Company=A&B+Example'. When i query this in my dashboard, I see the Company name as just A.

prateedshetty
Path Finder

Also if the company name were 'Company=Apple+Banana', how can I ignore the + to make the Company name look like Apple Banana once added in the dashboard.

Final Result should be:
Company
A&B Example
Apple Banana

How I see it now
Company
A
Apple+Banana

0 Karma
1 Solution

DalJeanis
Legend

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

View solution in original post

0 Karma

prateedshetty
Path Finder

This worked

sourcetype=abc| rex field=Company mode=sed "y/+/ /" |stats count by Company

0 Karma

DalJeanis
Legend

First, to get the data pulled into the company name at all, you'll probably have to get into the regex that is parsing the company name, and add "+" and "&" as valid characters. That may be a problem, because "&" especially may be used for other things in your _raw data, so there'll be a bit of testing involved.

Second, you may want to use rex to convert the "&" and "+" characters either into spaces or into nothing. The choice depends on how many of these you have in your data, and what variations need to be addressed.

If you want more specific advice, then you'll need to post the stanza that is extracting the Company from the data, and a few examples of _raw so we can be sure we have all necessary patterns covered.

0 Karma

prateedshetty
Path Finder

I just tried the below query to replace + with space.

sourcetype=abc "https://www.abc.com" | rex field=Company mode=sed "s/+/ /g" | Top Company

and I get --> Error in 'rex' command: Regex: quantifier does not follow a repeatable item

0 Karma

prateedshetty
Path Finder

This just worked though..

............| rex field=Company mode=sed "y/+/ /" |.......

0 Karma

DalJeanis
Legend

Good. glad you got it handled.

If that's all you needed, then please accept the answer so the question will show as closed.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...