Splunk Search

How to escape a parentheses in sed rex command ?

DavidHourani
Super Champion

Hello dearest Splunkers,

I am trying to convert "(A=hi) OR (B=bye)" to "(A=hi) NOT (B=bye)" using sed. So far I have the following command:

...| rex mode=sed field=search "s/\sOR\s\(/\sNOT\s\(/g"

This gives me the following error, since apparently the backslash isnt enough to escape the parentheses:

Error in 'rex' command: Regex: missing closing parenthesis

Can anyone help me out understanding how I can improve the regex or what I should use as an escape character instead of the backslash ?

Thank you.

Regards,
David

Tags (3)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Try

...| rex field=search mode=sed "s/ OR / NOT /g"

You don't need to use any special space characters unless you really need to (i.e. they may be tabs or something). It doesn't feel like you do so you can simplify.

And, if you DID need to include the parenthesis, you only need to escape them in the first half of the sed command (the match part).

... | rex field=orig_field mode=sed "s/\) OR \(/) NOT (/g"

I know it looks funny but it does work. For clarity, the first half (matching part) is \) OR \(. The second part, the substitute part, is ) NOT (.

Here's the run-anywhere examples.

With spaces:

| makeresults | eval orig_field="(A=hi) OR (B=bye)" 
| rex field=orig_field mode=sed "s/ OR / NOT /g"

With escaped parenthesis:

| makeresults | eval orig_field="(A=hi) OR (B=bye)" 
| rex field=orig_field mode=sed "s/\) OR \(/) NOT (/g"

Happy Splunking!
-Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

Try

...| rex field=search mode=sed "s/ OR / NOT /g"

You don't need to use any special space characters unless you really need to (i.e. they may be tabs or something). It doesn't feel like you do so you can simplify.

And, if you DID need to include the parenthesis, you only need to escape them in the first half of the sed command (the match part).

... | rex field=orig_field mode=sed "s/\) OR \(/) NOT (/g"

I know it looks funny but it does work. For clarity, the first half (matching part) is \) OR \(. The second part, the substitute part, is ) NOT (.

Here's the run-anywhere examples.

With spaces:

| makeresults | eval orig_field="(A=hi) OR (B=bye)" 
| rex field=orig_field mode=sed "s/ OR / NOT /g"

With escaped parenthesis:

| makeresults | eval orig_field="(A=hi) OR (B=bye)" 
| rex field=orig_field mode=sed "s/\) OR \(/) NOT (/g"

Happy Splunking!
-Rich

DavidHourani
Super Champion

yes this is the answer haha.. So regexes are only used in the first part of the sed, not both parts ! Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...