Splunk Search

Adjust fieldvalue (regex)

HeinzWaescher
Motivator

Hi,

I've got some fieldvalues like this:

field=aaaaaaaabbbbccccddddeeeeeeeeeeee

I would like to add a "-" after character 8,12,16 and 20:

field=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

Thanks for your help

Heinz

Tags (3)
0 Karma
1 Solution

dmlee
Communicator

Hi

if the length of this field is fixed , you can try this

alt text

View solution in original post

dmlee
Communicator

Hi

if the length of this field is fixed , you can try this

alt text

HeinzWaescher
Motivator

Hi dmlee,

yes, the length is fixed. "new_Heinz" is exaclty what I need 🙂 Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...