Dashboards & Visualizations

SEDCMD replacing special character with XML entity reference

sc0tt
Builder

I want to replace the character < with its XML entity reference &lt between a specific tag using SEDCMD in props.conf. (I left off the trailing ; so the text would display.)

Sed script:

s/(?<=<Text>)(.*?)(<)(.*?)(?=<\/Text>)/\1\&lt\3/g

Using the above script <Text>Some < stuff</Text> becomes <Text>Some &lt stuff</Text> but I'm not sure if this is the best/correct way to accomplish this. I'd appreciate any advice.

Thanks.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

This works if you have at most one <Text> tag with an arbitrary number of opening angle brackets:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<(?!(.*?<)?Text>)(?=.*?<\/Text>)/\&ltsemicolon/g"

Here's an entirely different approach that should work for an arbitrary number of <Text> tags:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<Text>/<Text><![CDATA[/g" | rex mode=sed "s/<\/Text>/]]<\/Text>/g"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

This works if you have at most one <Text> tag with an arbitrary number of opening angle brackets:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<(?!(.*?<)?Text>)(?=.*?<\/Text>)/\&ltsemicolon/g"

Here's an entirely different approach that should work for an arbitrary number of <Text> tags:

| stats count | eval _raw = "<noText>no < text < ...</noText><Text>text < 1 < 2 << 3<4<</Text><meh>foo < bar</meh>" | rex mode=sed "s/<Text>/<Text><![CDATA[/g" | rex mode=sed "s/<\/Text>/]]<\/Text>/g"

sc0tt
Builder

Thanks for help. I'm going to test these and see if this works for my need. I want to clean up some logs and format tags as kv pairs before they are indexed.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Oops... 😛

0 Karma

jonuwz
Influencer

are you missing a closing in the 2nd example ?

0 Karma

sc0tt
Builder

Good question. It can appear any number of times. It looks like I didn't account for that.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

How often can the opening angle bracket appear within that Text tag?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...