Splunk Search

Append string to end of log file if regex match is true

jazzijeff
New Member

Im trying to get a way to have SED (via search)  append a string to the raw log in the results window if a condition is met anywhere in the raw log file - in the example below if i find any series of six numbers

index=* | rex mode=sed "s/(?<myTest>[0-9]{1,6})/\2<myTestFound>/g

 

What i would like is the following -and note the "<myTestFound>" at the end

<MyData>"This is my raw log with 123456 present and 987654 also present</MyData><myTestFound>

 

But all i have been able to do so far is 

<MyData>"This is my raw log with 123456<myTestFound> present and 987654<myTestFound> also present</MyData>

 

Can anyone give me some assistance in getting the first option going? thanks

Labels (2)
Tags (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "end of log"? Splunks returns results from search (and operates on them with streaming commands) one event at a time.

Futrthermore, rex's sed doesn't accept any other modifiers than "g" or a number which means that it won't work in multiline mode. So best you can do with sed-mode is append a string at the end of the line. It's meant for data anonymization rather than some fancy sed-voodoo.
If you only want to append a string to the end of the event, why don't you just do eval appending said string to the _raw field?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/(?<myTest>[0-9]{1,6}.*)/\1<myTestFound>/g"
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...