Getting Data In

SEDCMD tab insert

wsweat
Explorer

Hello,

Using the SEDCMD (props.conf), I want to replace a char string '#11' with a tab. However, when I use:

SEDCMD-fix_tab = s/#011/\t/g

or

SEDCMD-fix_tab = s/#011/\\t/g

or

SEDCMD-fix_tab = s/#011/\x09/g

The char #011 is replaced by the literal string '\t', '\t', or '\x09' and not with the= tab character. I've even tested this successfully using the sed -r equivalent on the CLI

Any help is appreciated. Thanks

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

This should work:

SEDCMD-fix_tab = s/#011/ /g

The space before the "/g" is an actual/literal tab. (ie., hit TAB button on your keyboard)

Hope this helps,

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

This should work:

SEDCMD-fix_tab = s/#011/ /g

The space before the "/g" is an actual/literal tab. (ie., hit TAB button on your keyboard)

Hope this helps,

d.

_d_
Splunk Employee
Splunk Employee

Glad that you made it work. Also, note that the replaced field is not a regex. The correct syntax is:

s/regex/replacement/flags

0 Karma

wsweat
Explorer

Thanks, that's what I decided to do and it seemed to work. It just looked odd as I'm used to using character sequences, like '\t', to indicate a tab; and the assumption that this field would be regex (pcre) compliant as well.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...