Splunk Search

Remove character pattern from field value

bcarr12
Path Finder

In one of my logs, I have some fields that return values such as:
status=FA-Full Pulse AOV Access Realm)[
status=FA-Full Pulse AOV Access Realm)[FA-CGK Bypass Role
status=unknown)[

What is the best way to strip the ")[" pattern from each of these values and replace with something like a blank space (ie " "). I tried replace ")[" WITH " " IN status but it doesn't seem to be doing anything.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Replace should work, but perhaps it's confused by the paren and bracket. Try rex. It will be confused by the paren and bracket so they'll need to be escaped.

rex mode=sed "s/\)\[/ /g"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Replace should work, but perhaps it's confused by the paren and bracket. Try rex. It will be confused by the paren and bracket so they'll need to be escaped.

rex mode=sed "s/\)\[/ /g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

bcarr12
Path Finder

Thanks! This works great.

0 Karma

bcarr12
Path Finder

If I can be a pain - can rex also be used if I wanted to replace the )[ with something like a pipe? Just trying to find an easy way to seperate the values when there is more than one status.

For instance:
status=FA-Full Pulse AOV Access Realm |
status=FA-Full Pulse AOV Access Realm | FA-CGK Bypass Role
status=unknown |

0 Karma

lguinn2
Legend

If you want to permanently remove these characters, that can be done at parsing time.

props.conf

[yoursourcetypehere]
TRANSFORMS=fixChar

transforms.conf

[fixChar]
SOURCE_KEY=_raw
REGEX=(.*)\)\[(.*)
DEST_KEY=_raw
FORMAT=$1 $2

You might not want to set this up exactly as I have shown in this example, but it will probably work. Remember that you can't use the status field in the transform, because it doesn't exist at this point.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...