Getting Data In

SEDCMD tab insert

wsweat
Explorer

Hello,

Using the SEDCMD (props.conf), I want to replace a char string '#11' with a tab. However, when I use:

SEDCMD-fix_tab = s/#011/\t/g

or

SEDCMD-fix_tab = s/#011/\\t/g

or

SEDCMD-fix_tab = s/#011/\x09/g

The char #011 is replaced by the literal string '\t', '\t', or '\x09' and not with the= tab character. I've even tested this successfully using the sed -r equivalent on the CLI

Any help is appreciated. Thanks

Tags (1)
1 Solution

_d_
Splunk Employee
Splunk Employee

This should work:

SEDCMD-fix_tab = s/#011/ /g

The space before the "/g" is an actual/literal tab. (ie., hit TAB button on your keyboard)

Hope this helps,

d.

View solution in original post

_d_
Splunk Employee
Splunk Employee

This should work:

SEDCMD-fix_tab = s/#011/ /g

The space before the "/g" is an actual/literal tab. (ie., hit TAB button on your keyboard)

Hope this helps,

d.

_d_
Splunk Employee
Splunk Employee

Glad that you made it work. Also, note that the replaced field is not a regex. The correct syntax is:

s/regex/replacement/flags

0 Karma

wsweat
Explorer

Thanks, that's what I decided to do and it seemed to work. It just looked odd as I'm used to using character sequences, like '\t', to indicate a tab; and the assumption that this field would be regex (pcre) compliant as well.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...