Getting Data In

Removing Backslash

vpsmax
Path Finder

Good morning.

Trying to replace a "\" (backslash) from a string.  Below is my example ...

# Perform Global Replace for "&dir+c:\ 443"
SEDCMD-replace_backslash_1 = s/\&\w+\+\w\:\\\s443/&dir+c: 443/g

For some reason, the pattern match is not able to detect the backslash.  Are there any special considerations when trying to remove a backslash?

Regards,
Max

 

Labels (2)
1 Solution

vpsmax
Path Finder

Hi Giuseppe,

Good morning. Thank you for your guidance on this. Strangely, we tried what you mentioned ...

SEDCMD-replace-backslash_1 = s/\\\//g

But it did not work. The TA which contains the props.conf and the sourcetype definition were installed on both the Indexers and the HF. Instead, we tried the following ...

SEDCMD-replace-backslash_1 = s/(\\\s)/ /g

And for some reason, this worked! I suppose there are some considerations when using SEDCMD.

Regards,
Max

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vpsmax,

try this simple regex:

SEDCMD-replace_backslash_1 = s/:\\\/:/g

that you can test in a search like this:

| makeresults 
| eval my_field="&dir+c:\ 443" | rex field=my_field mode=sed "s/:\\\/:/g"

Ciao.

Giuseppe

vpsmax
Path Finder

Thanks.  While the search works as expected, the SEDCMD command does not seem to be picking up.  The Indexers and the Heavy Forwarder have been restarted.  A new set of entries have been added using "oneshot".  Any suggestions on how to get the SEDCMD command to work properly?

 

gcusello
SplunkTrust
SplunkTrust

Hi @vpsmax,

props.conf and transforms.conf must be on Indexers or on Heavy Forwarders (when present) and to be sure you can put them in both servers (as you did, remember to restart Splunk).

If your regex doesn't run, check if the sourcetype where you inserted the SEDCMD is correct and try another easier regex :

SEDCMD-replace_backslash_1 = s/\\\//g

Ciao.

Giuseppe

vpsmax
Path Finder

Hi Giuseppe,

Good morning. Thank you for your guidance on this. Strangely, we tried what you mentioned ...

SEDCMD-replace-backslash_1 = s/\\\//g

But it did not work. The TA which contains the props.conf and the sourcetype definition were installed on both the Indexers and the HF. Instead, we tried the following ...

SEDCMD-replace-backslash_1 = s/(\\\s)/ /g

And for some reason, this worked! I suppose there are some considerations when using SEDCMD.

Regards,
Max

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vpsmax,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: please accept the answer for the other people of Community and Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...