Archive

How can I do a find/replace on the results found to make them more readable?

dlespron
Path Finder

For instance, I have a log that returns many results and in between different fields I have a \x1 that I would like to replace with a space in order to make it more readable to the user. How can I tell splunk to find all the instances of \x1 and replace them with a space? Any input would be greatly appreciated!

Thanks!

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

In the search query (search time)

<your base search> | rex mode=sed "s/x1/ /g"

Index time (props.conf)

[yoursourcetype]
SEDCMD-changex1 = s/x1/ /g

View solution in original post

somesoni2
Revered Legend

In the search query (search time)

<your base search> | rex mode=sed "s/x1/ /g"

Index time (props.conf)

[yoursourcetype]
SEDCMD-changex1 = s/x1/ /g

View solution in original post

dlespron
Path Finder

done thanks!

0 Karma

somesoni2
Revered Legend

Glad it helped. Please mark the question answered if everything looks good.

0 Karma

dlespron
Path Finder

that works great, thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try '| rex mode=sed "s/x1/ /g"'.

---
If this reply helps you, an upvote would be appreciated.

dlespron
Path Finder

awesome, that worked great! thanks so much for your help!

0 Karma