Getting Data In

I am trying to remove all the special characters in the field and replace them with space character using sed mode in rex command.

Engager

First I tried to search for chars which aren't alphanumeric and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[^a-zA-Z0-9]/ /g"*

This does work fine but when I try the other approach as shown below

Second approach was to find all the special characters and replace them with space character.
source="Regex.zip:" | rex mode=sed field="Incident Description" "s/[!@#$%^&()-?/{}<|>\:;]/ /g"

This does display an error: Error in 'rex' command: Regex: missing terminating ] for character class

This the data I was working on

Path Finder
0 Karma

SplunkTrust
SplunkTrust

For completion and in order to avoid complicated syntax I would use the following regex instead:

| rex mode=sed "s/\W+/ /g"

Or if you want to have a more granular control:

| rex mode=sed "s/[^a-zA-Z0-9_\-\.]+/ /g"

Path Finder

how to use this during parsing time or props.conf

0 Karma

SplunkTrust
SplunkTrust

Take a look at the following http://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Anonymizedata as it'll explain this better than me.

The concept is the same.

0 Karma

Legend

Try escaping the special characters

... | rex mode=sed "s/\\[\!\@\#\$\%\^\&\(\)\-\?\/\{\}\<\|\>\\\\\:\;]/ /g""
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!