Splunk Search

Remove character pattern from field value

bcarr12
Path Finder

In one of my logs, I have some fields that return values such as:
status=FA-Full Pulse AOV Access Realm)[
status=FA-Full Pulse AOV Access Realm)[FA-CGK Bypass Role
status=unknown)[

What is the best way to strip the ")[" pattern from each of these values and replace with something like a blank space (ie " "). I tried replace ")[" WITH " " IN status but it doesn't seem to be doing anything.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Replace should work, but perhaps it's confused by the paren and bracket. Try rex. It will be confused by the paren and bracket so they'll need to be escaped.

rex mode=sed "s/\)\[/ /g"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Replace should work, but perhaps it's confused by the paren and bracket. Try rex. It will be confused by the paren and bracket so they'll need to be escaped.

rex mode=sed "s/\)\[/ /g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

bcarr12
Path Finder

Thanks! This works great.

0 Karma

bcarr12
Path Finder

If I can be a pain - can rex also be used if I wanted to replace the )[ with something like a pipe? Just trying to find an easy way to seperate the values when there is more than one status.

For instance:
status=FA-Full Pulse AOV Access Realm |
status=FA-Full Pulse AOV Access Realm | FA-CGK Bypass Role
status=unknown |

0 Karma

lguinn2
Legend

If you want to permanently remove these characters, that can be done at parsing time.

props.conf

[yoursourcetypehere]
TRANSFORMS=fixChar

transforms.conf

[fixChar]
SOURCE_KEY=_raw
REGEX=(.*)\)\[(.*)
DEST_KEY=_raw
FORMAT=$1 $2

You might not want to set this up exactly as I have shown in this example, but it will probably work. Remember that you can't use the status field in the transform, because it doesn't exist at this point.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...