Splunk Search

Append string to end of log file if regex match is true

jazzijeff
New Member

Im trying to get a way to have SED (via search)  append a string to the raw log in the results window if a condition is met anywhere in the raw log file - in the example below if i find any series of six numbers

index=* | rex mode=sed "s/(?<myTest>[0-9]{1,6})/\2<myTestFound>/g

 

What i would like is the following -and note the "<myTestFound>" at the end

<MyData>"This is my raw log with 123456 present and 987654 also present</MyData><myTestFound>

 

But all i have been able to do so far is 

<MyData>"This is my raw log with 123456<myTestFound> present and 987654<myTestFound> also present</MyData>

 

Can anyone give me some assistance in getting the first option going? thanks

Labels (2)
Tags (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "end of log"? Splunks returns results from search (and operates on them with streaming commands) one event at a time.

Futrthermore, rex's sed doesn't accept any other modifiers than "g" or a number which means that it won't work in multiline mode. So best you can do with sed-mode is append a string at the end of the line. It's meant for data anonymization rather than some fancy sed-voodoo.
If you only want to append a string to the end of the event, why don't you just do eval appending said string to the _raw field?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/(?<myTest>[0-9]{1,6}.*)/\1<myTestFound>/g"
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...