Getting Data In

SEDCMD trouble- How to delete vfwew from field account?


Hello everyone!

I'm trying to make props file which will trim all not cyrillic symbols from field "account"

My log example is 

18:10:24 Object="some object" Source="some source1323" Account="Аккаунтvfweцw"

i want to delete vfwew from field Account, but note that symbols can go in any order and with cyrillic symbols too, i need to catch them all and delete, only from one field

SEDCMD-notcyr - Account="....


Labels (3)
0 Karma


There is no way to do it with just a SEDCMD. The y command would match character class anywhere in the event and with s command you can't either restrict matching to a specific field (there is no notion of fields at this point at all) or match (for substitution) a string with holes in it.


hi @bosseres 

Try something like this...



| makeresults 
| eval Account="Аккаунтvfweцw"
| rex field=Account mode=sed "s/[^А-Яа-я]+//g"
| table Account

~ If the reply helps, a Karma upvote would be appreciated

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...