Splunk Search

How to remove "\n" character from string

guest_123
Engager

I have a serialized json string like below 

"{\n \"ID\": \"da419500-f6b4-11ec-8b49-025041000001\",\n \"Name\": \"splunk\",\n \"message\": \"demo\",\n \"tracePoint\": \"START\",\n \"priority\": \"ERROR\",\n \"flowName\": \"demo1\",\n \"timestamp\": \"2022-06-27T16:33:17.175289Z\",\n \"content\": {\n \"payload\": {\n \"message\": \"Hello world!\"\n }\n }\n}"

I need to remove all the "\n" form this string 

"{ \"ID\": \"da419500-f6b4-11ec-8b49-025041000001\", \"Name\": \"splunk\", \"message\": \"demo\", \"tracePoint\": \"START\", \"priority\": \"ERROR\", \"flowName\": \"demo1\", \"timestamp\": \"2022-06-27T16:33:17.175289Z\", \"content\": { \"payload\": { \"message\": \"Hello world!\" } } }" 

I tried rex field=myField mode=sed "s/\\n/ /g"  and also replace function both seems to be not helping 

 

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

You should add one more \ to rex cmd like

| rex mode=sed field=myField "s/\\\n/ /g"

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You should add one more \ to rex cmd like

| rex mode=sed field=myField "s/\\\n/ /g"

guest_123
Engager

thank you @isoutamo 

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...