Splunk Enterprise

How to manipulate field values in raw log?

super_saiyan
Communicator

How do i replace the Hyphen with dot.

For example i have a field call IP and the value are 10-20-11-120 but i want to convert this to 10.20.11.120.

I have tried the | rex mode=sed but it's only replacing the first hyphen with dot. Please refer to my below SPL

SPL

| makeresults | eval IP="10-20-11-120"
| rex mode=sed field=IP "s/-/./"

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed field=IP "s/-/./g"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed field=IP "s/-/./g"

richgalloway
SplunkTrust
SplunkTrust

Make the SED operation repeat by using the 'g' flag.

| makeresults | eval IP="10-20-11-120"
| rex mode=sed field=IP "s/-/./g"
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...