Getting Data In

I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

anjanikumar
Engager

First I tried to search for chars which aren't alphanumeric and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[^a-zA-Z0-9]/ /g"*

This does work fine but when I try the other approach as shown below

Second approach was to find all the special characters and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[!@#$%^&()-?/{}<|>\:;]/ /g"

This does display an error: Error in 'rex' command: Regex: missing terminating ] for character class

This the data I was working on

mad4wknds
Path Finder
0 Karma

javiergn
Super Champion

For completion and in order to avoid complicated syntax I would use the following regex instead:

| rex mode=sed "s/\W+/ /g"

Or if you want to have a more granular control:

| rex mode=sed "s/[^a-zA-Z0-9_\-\.]+/ /g"

neelamsantosh
Path Finder

how to use this during parsing time or props.conf

0 Karma

javiergn
Super Champion

Take a look at the following http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Anonymizedata as it'll explain this better than me.

The concept is the same.

0 Karma

sundareshr
Legend

Try escaping the special characters

... | rex mode=sed "s/\\[\!\@\#\$\%\^\&\(\)\-\?\/\{\}\<\|\>\\\\\:\;]/ /g""
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...