Getting Data In

Problem with removing spaces using sed - with <> characters present

Ttreb
New Member
<Update> <data> <user> <dialogs>/finesse/api/User/72741/Dialogs</dialogs> <extension></extension> <firstName>Bert</firstName> <lastName>Smith</lastName>

Trying to remove the spaces between > and <

I have tried the following - several of the patterns I have tried work fine on REgex testing sites but fail for use in Splunk

I started using ZZ just as a marker to see what effect the replace was having as using >< seems to fail in any use. I checked and the charaters >< are not regex special characters

| rex field=myraw mode=sed "s/(> <)/ZZ/g" - No effect

| rex field=myraw mode=sed "s/(\W \W)/ZZ/g" - inconsistent replaces

<notification><Update>ZZ<data>ZZZZuser>ZZZZ <dialogs>/finesse/api/User/72741/Dialogs</dialogs>ZZZZ <extension>511835</extension>ZZZZ <firstName>Bert</firstName>ZZZZ <lastName>Smith</lastName>ZZZZ 

| rex field=myraw mode=sed "s/\x{3e} \x{3c}/ZZ/g" - no effect

Not sure now whether Splunk has issues with <> or what - its confusing that I can get this to work in several ways testing on regex sites.

Thanks

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@Ttreb ,

Try

|rex field=your_field_name mode=sed "s/>\s+<//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@Ttreb ,

Try

|rex field=your_field_name mode=sed "s/>\s+<//g"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

Ttreb
New Member

Thanks for the response that does the trick - was driving me batty trying to work out - just couldn't nail the right pattern.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...