Getting Data In

Problem with removing spaces using sed - with <> characters present

Ttreb
New Member
<Update> <data> <user> <dialogs>/finesse/api/User/72741/Dialogs</dialogs> <extension></extension> <firstName>Bert</firstName> <lastName>Smith</lastName>

Trying to remove the spaces between > and <

I have tried the following - several of the patterns I have tried work fine on REgex testing sites but fail for use in Splunk

I started using ZZ just as a marker to see what effect the replace was having as using >< seems to fail in any use. I checked and the charaters >< are not regex special characters

| rex field=myraw mode=sed "s/(> <)/ZZ/g" - No effect

| rex field=myraw mode=sed "s/(\W \W)/ZZ/g" - inconsistent replaces

<notification><Update>ZZ<data>ZZZZuser>ZZZZ <dialogs>/finesse/api/User/72741/Dialogs</dialogs>ZZZZ <extension>511835</extension>ZZZZ <firstName>Bert</firstName>ZZZZ <lastName>Smith</lastName>ZZZZ 

| rex field=myraw mode=sed "s/\x{3e} \x{3c}/ZZ/g" - no effect

Not sure now whether Splunk has issues with <> or what - its confusing that I can get this to work in several ways testing on regex sites.

Thanks

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@Ttreb ,

Try

|rex field=your_field_name mode=sed "s/>\s+<//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@Ttreb ,

Try

|rex field=your_field_name mode=sed "s/>\s+<//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Ttreb
New Member

Thanks for the response that does the trick - was driving me batty trying to work out - just couldn't nail the right pattern.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...