Splunk Search

Can you help me create the regex to replace multiple characters in the following field?

sistemistiposta
Path Finder

Hello,

I extracted a field like this:

folder="prova^1.ED56GH"

and I want to change it at search time by replacing all dots with "/", and then all ^ with dot. In the example I will obtain:

folder="prova.1/ED56GH"

I write in props.conf:

EVAL-folder = if ( match(folder, "."), replace(folder, "([^\.]+)\.(.+)", "\1/\2"), folder)

to replace "." with "/". But I can't retype:

EVAL-folder = if ( match(folder, "^"), replace(folder, "([^\^]+)\^(.+)", "\1.\2"), folder)

to replace ^ with "." after first EVAL. It doesn't work.
So, how can I achieve this?

Many many thanks!

Marco

0 Karma
1 Solution

whrg
Motivator

Hi! Check this out:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"

Then you get:

folder
prova.1/ED56GH

Alternatively:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")

You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.

View solution in original post

0 Karma

whrg
Motivator

Hi! Check this out:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"

Then you get:

folder
prova.1/ED56GH

Alternatively:

| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")

You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.

0 Karma

sistemistiposta
Path Finder

I was sure to forget some tricks 🙂
Thank you very much @whrg. What I'm looking for is the alternative:
folder=replace(replace(folder,"\.","/"),"\^",".")
which I can add in props.conf.

Thank you very much, have a great day!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...