Splunk Search

Can you help me create the regex to replace multiple characters in the following field?

sistemistiposta
Path Finder

Hello,

I extracted a field like this:

folder="prova^1.ED56GH"

and I want to change it at search time by replacing all dots with "/", and then all ^ with dot. In the example I will obtain:

folder="prova.1/ED56GH"

I write in props.conf:

EVAL-folder = if ( match(folder, "."), replace(folder, "([^\.]+)\.(.+)", "\1/\2"), folder)

to replace "." with "/". But I can't retype:

EVAL-folder = if ( match(folder, "^"), replace(folder, "([^\^]+)\^(.+)", "\1.\2"), folder)

to replace ^ with "." after first EVAL. It doesn't work.
So, how can I achieve this?

Many many thanks!

Marco

0 Karma
1 Solution

whrg
Motivator

Hi! Check this out:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"

Then you get:

folder
prova.1/ED56GH

Alternatively:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")

You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.

View solution in original post

0 Karma

whrg
Motivator

Hi! Check this out:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"

Then you get:

folder
prova.1/ED56GH

Alternatively:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")

You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.

0 Karma

sistemistiposta
Path Finder

I was sure to forget some tricks 🙂
Thank you very much @whrg. What I'm looking for is the alternative:
folder=replace(replace(folder,"\.","/"),"\^",".")
which I can add in props.conf.

Thank you very much, have a great day!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...