Splunk Search

Replace A pattern Splunk

baranova
New Member

Hello Guys ,

I have a field Month that have values like this

1-2013
10-2014
9-2014

i would like to get 0X-YYYY if month <10

so 1-2013 becomes 01-2013
10-2014 stays 10-2014
9-2014 becomes 09-2014

I've tried rex mode=sed field="Month" "s/(^[0-9]-.*)/0\1/" (it works fine on linux but not on Splunk ..)

Could you help me ?

Thanks !

Tags (1)
0 Karma

grijhwani
Motivator

I'm not familiar with sed mode, but have you tried escaping the square brackets with a backslash. Whenever a regex fails to match the expected results my first thought is always escaping special characters. Some regex modes assume special meaning unless expressly suppressed whilst others are the reverse, and just for fun some assume special meaning for one subset whilst not for others. It can be mind-bendingly confusing.

0 Karma

HiroshiSatoh
Champion

about using eval?

・・・|eval Month=if(len(Month)==6,"0"+Month,Month)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...