I have a SED command in props.conf as below
SEDCMD-replace-name = s/ethan/thomas/g
This will replace all ethan with thomas for sure and worked . But the question is if i want to keep the first one as not replaced and replace all second one till end , what should write the command .
I tried the below ,
1) SEDCMD-replace-name = s/ethan/thomas/2g
Result - No replace is happening on anything
2) SEDCMD-replace-name = s/ethan/thomas/2
Result - replace is happening only on 2nd 'ethan' as 'thomas' .
Is there a way i can specify the range of numbers here such as 2 to 10 , or 2 to end like that ? please help.
The Search Reference manual is pretty clear that SEDCMD can take either a 'g' or a number. The former will replace all matches whereas the latter replaces the specified single match. There is no option to replace some of the matches, but you can do to https://ideas.splunk.com to make a case for it.