How can I do a find/replace on the results found to make them more readable?

[dlespron]

For instance, I have a log that returns many results and in between different fields I have a \x1 that I would like to replace with a space in order to make it more readable to the user. How can I tell splunk to find all the instances of \x1 and replace them with a space? Any input would be greatly appreciated!

Thanks!

[somesoni2 · Accepted solution]

In the search query (search time)

<your base search> | rex mode=sed "s/x1/ /g"

Index time (props.conf)

[yoursourcetype]
SEDCMD-changex1 = s/x1/ /g

[dlespron]

done thanks!

[somesoni2]

Glad it helped. Please mark the question answered if everything looks good.

[dlespron]

that works great, thanks!

[richgalloway]

Try '| rex mode=sed "s/x1/ /g"'.

[dlespron]

awesome, that worked great! thanks so much for your help!