This does just the first 2:
... | rex field=myField mode=sed "s/(.)(.)/\2\1/" | table host
Extend the example (more
(.) in the first section and more
\# in the second section) to reverse longer strings.
This byteswaps an entire string of any length (every pair):
... | rex field=myField mode=sed "s/(.)(.)/\2\1/g" | table host
I would suggest one correction to add "g" flag in the end to do it for all characters. like
Don't forget to accept the answer by clicking on the Accept hyperlink below the answer.
Hey thanks I just ran what you mentioned but its only swapping the first 2 characters.
Value to swap = 535276
Swapped value 355276
Changing the lengths doesnt seem to work?
Did you add the 'g' in the end as mentioed in the comment? Try this runanywhere sample search
| gentimes start=-1 | eval myField="535276" | rex field=myField mode=sed "s/(.)(.)/\2\1/g"