Dashboards & Visualizations

SEDCMD replacing special character with XML entity reference

sc0tt
Builder

I want to replace the character < with its XML entity reference &lt between a specific tag using SEDCMD in props.conf. (I left off the trailing ; so the text would display.)

Sed script:

s/(?<=<Text>)(.*?)(<)(.*?)(?=<\/Text>)/\1\&lt\3/g

Using the above script <Text>Some < stuff</Text> becomes <Text>Some &lt stuff</Text> but I'm not sure if this is the best/correct way to accomplish this. I'd appreciate any advice.

Thanks.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This works if you have at most one <Text> tag with an arbitrary number of opening angle brackets:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<(?!(.*?<)?Text>)(?=.*?<\/Text>)/\&ltsemicolon/g"

Here's an entirely different approach that should work for an arbitrary number of <Text> tags:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<Text>/<Text><![CDATA[/g" | rex mode=sed "s/<\/Text>/]]<\/Text>/g"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This works if you have at most one <Text> tag with an arbitrary number of opening angle brackets:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<(?!(.*?<)?Text>)(?=.*?<\/Text>)/\&ltsemicolon/g"

Here's an entirely different approach that should work for an arbitrary number of <Text> tags:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<Text>/<Text><![CDATA[/g" | rex mode=sed "s/<\/Text>/]]<\/Text>/g"

sc0tt
Builder

Thanks for help. I'm going to test these and see if this works for my need. I want to clean up some logs and format tags as kv pairs before they are indexed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Oops... 😛

0 Karma

jonuwz
Influencer

are you missing a closing in the 2nd example ?

0 Karma

sc0tt
Builder

Good question. It can appear any number of times. It looks like I didn't account for that.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How often can the opening angle bracket appear within that Text tag?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...