Is there a way to use a rex command with mode=sed against a specific field in a config file (props.conf)??
I understand how to use the SEDCMD in the props but that pre-processes and only appears to go against _raw (since the fields wouldn't be defined yet). Is there a way to do the following:
rex mode=sed field=a "s/this/that/g"
via config files?? Preferably at search time?
Thanks,
-Bob
You can do something like this in props.conf to define a calculated field at search time:
EVAL-foo = replace(a, "this", "that")
Note, field a
cannot come from a lookup because that's looked up too late, see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf for reference.
You can do something like this in props.conf to define a calculated field at search time:
EVAL-foo = replace(a, "this", "that")
Note, field a
cannot come from a lookup because that's looked up too late, see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf for reference.