Splunk Search

Issue using rex to replace string

Scharf
Explorer

Hello world,

I'm trying to use rex to rename the part of the strings below where it says "g0" to "GRN". So the output would read 01-GRN1-0, 01-GRN2-0etc. I have been unable to get it to work and any guidance to point me in the right direction would be much appreciated.
The rex statement in question:

| rex field=ThisField mode=sed "s/g0/\GRN/g"

Example strings:

01-g01-0

01-g02-0

01-g03-0

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You don't need the backslash - here is a runanywhere example showing it working

| makeresults
| fields - _time
| eval ThisField=split("01-g01-0
01-g02-0
01-g03-0","
")
| mvexpand ThisField
| rex field=ThisField mode=sed "s/g0/GRN/g"

View solution in original post

Scharf
Explorer

Yeah I tried that first, but other related issues on the boards led me to try it with the backslash. It returns the same results.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The search works as shown which probably means there is something different in your environment which hasn't been made clear to us. Please can you provide more details and examples of where this substitution is not working as expected?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You don't need the backslash - here is a runanywhere example showing it working

| makeresults
| fields - _time
| eval ThisField=split("01-g01-0
01-g02-0
01-g03-0","
")
| mvexpand ThisField
| rex field=ThisField mode=sed "s/g0/GRN/g"

Scharf
Explorer

It turns out the cause of my issue was another rex statement down the line that hadn't been updated to match the renamed string. It used 

(?<Foo>\D\d*)-0

which matched the string before the replacement, which the statement is now

(?<Foo>\D*\d)-0

Apologies for my confusion. I've marked your efforts as the solution as the backslash was indeed not needed.

Thank you and have some Karma for your efforts.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you should remove \ before G.

r. Ismo

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...