Amending certain characters for values in an extracted field

[ajm33]

I'm currently trying to join two log events across separate sources using their file name. The issue i have run in to is that within one log set the spaces in file names are replaced by underscores (for instance "abcd efg.csv" becomes "abcd_efg.csv") whereas the other source maintained the spaces ("abcd efg.csv" remains "abcd efg.csv").

As a result i'm not able to join on the filename. Can anyone help is an expression that would edit the values for the filename field. I'm thinking some kind of eval that replaces any spaces it finds with underscores, however i've not come across away to do this.

Your assistance would be much appreciated.

** Issue resolved using replace **

| rex "(?i)\/xyz\/\w+\/(?P.+).(csv|xls)" | eval FileNameNoSpaces = replace(FileName,"\s","_")

FileNameNoSpaces can then be used to join effectively.

[ajm33]

Issue resolved using replace
| rex "(?i)/xyz/w+/(?P.+).(csv|xls)" | eval FileNameNoSpaces = replace(FileName,"s","_")

FileNameNoSpaces can then be used to join effectively.

[matthieu_araman]

Hello,

you could try something like that | rex field=_raw mode=sed "s/\s/_/g"
replace field=_raw with field=yourownfield to avoir replacing space everywhere
you could also add a form more specific in the sed expression or just keep it simple.

[MuS]

Hi ajm33,

take a look at this answer to get an idea to do this without join http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...

The Answer lists sourcetypebut you can do the same over multiple sources.
If this is not possible for your use case, provide some sample events and search you used.

cheers, MuS