Splunk Search

How can I do a find/replace on the results found to make them more readable?

dlespron
Path Finder

For instance, I have a log that returns many results and in between different fields I have a \x1 that I would like to replace with a space in order to make it more readable to the user. How can I tell splunk to find all the instances of \x1 and replace them with a space? Any input would be greatly appreciated!

Thanks!

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In the search query (search time)

<your base search> | rex mode=sed "s/x1/ /g"

Index time (props.conf)

[yoursourcetype]
SEDCMD-changex1 = s/x1/ /g

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

In the search query (search time)

<your base search> | rex mode=sed "s/x1/ /g"

Index time (props.conf)

[yoursourcetype]
SEDCMD-changex1 = s/x1/ /g

dlespron
Path Finder

done thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Glad it helped. Please mark the question answered if everything looks good.

0 Karma

dlespron
Path Finder

that works great, thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try '| rex mode=sed "s/x1/ /g"'.

---
If this reply helps you, Karma would be appreciated.

dlespron
Path Finder

awesome, that worked great! thanks so much for your help!

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...