- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
super_saiyan
Communicator
10-17-2022
06:09 AM
How do i replace the Hyphen with dot.
For example i have a field call IP and the value are 10-20-11-120 but i want to convert this to 10.20.11.120.
I have tried the | rex mode=sed but it's only replacing the first hyphen with dot. Please refer to my below SPL
SPL
| makeresults | eval IP="10-20-11-120"
| rex mode=sed field=IP "s/-/./"
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
10-17-2022
06:44 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
10-17-2022
06:44 AM
| rex mode=sed field=IP "s/-/./g"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
10-17-2022
06:43 AM
Make the SED operation repeat by using the 'g' flag.
| makeresults | eval IP="10-20-11-120"
| rex mode=sed field=IP "s/-/./g"
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
