Archive

Replace field value using rex

Path Finder

XXXXXX y XXXXXX y

So this is my value of a field z . How to replace this with XXXXXX y.

Below is not working

rex mode=sed field=z "s/XXXXXX y XXXXXX y/XXXXXX y/g"

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

Try this:

rex mode=sed field=z "s/(XXXXXX\s+y)\s+XXXXXX\s+y/\1/g"

the \s+ should grab tabs and whitespace. The parens () and \1 will make the first part of that string a capture group, and use what is captured as the replacement.

0 Karma

Super Champion

i tried this it seems to be working-

| makeresults |eval z="XXXXXX y XXXXXX y"|rex mode=sed field=z "s/XXXXXX y XXXXXX y/XXXXXX y/g"

what is expected output ..can you provide some details..

0 Karma

Path Finder

when we do eval , it works .

when i do directly after the stats command ,it is not

0 Karma