Getting Data In

After using an SED command in props.conf, how come our query with the replace command is no longer working?

cyber_castle
Path Finder

Hello,

I have one of the field in Cyberark which has a special character.

Retrieve [File
Monitor [FW] end
Monitor [FW] start
Monitor [DR] end
Monitor DR] start
Open File
Set Password
Logon
Logoff
Monitor Backup] end

SED Command in props.conf --> SEDCMD-cef_name = s/[][]/ /g

I have used SED command in props to replace the special characters, but the client is not happy because we are altering the real data and its syntax. Then, I have reverted the change and tried using the replace command, but for some reason, my replace command is not working.

replace(cef_name, "[ ]", "")

0 Karma
1 Solution

whrg
Motivator

Hello @cyber_castle,

If I understand correctly, you want to remove special characters while running a search.

Note that there is a replace command as well as a replace eval function.

I think you are better off here with the eval function:

| eval cef_name=replace(cef_name,"[\[\]]"," ")

View solution in original post

0 Karma

whrg
Motivator

Hello @cyber_castle,

If I understand correctly, you want to remove special characters while running a search.

Note that there is a replace command as well as a replace eval function.

I think you are better off here with the eval function:

| eval cef_name=replace(cef_name,"[\[\]]"," ")
0 Karma

cyber_castle
Path Finder

Thanks for your answer. It worked.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...