Splunk Search

Replace string

john
Communicator

I want to replace (" ") in my xml file to single (").Since there is some misplace of double codes in my whole file.So please help
<?xml version=""1.0"" encoding=""ISO-9000-1"" ?>

Tags (1)

gooza
Communicator

try:

yoursearch | rex mode=sed "s/\"\"/\"/g"

john
Communicator

Thanks gooza.its working

0 Karma

kjamsheed
New Member

works for me as well

0 Karma

Michael
Contributor

I had to add the field name to make mine work:
(replacing + with a space in my case)

rex mode=sed field=search_term_used "s/+/ /g"

Also, in my case I had to escape the +

weird, when I post this comment, the rex line looses the escape character .

0 Karma

Livia
Engager

Have you tried to open the xml file with an editor, most of them have a find an replace function.

0 Karma

john
Communicator

I should not replace any values manually in the file.I meant i want to replace that double codes during time of search only since it should not make any permanent change in xml file.Can u suggest any search query for that

0 Karma

meenal901
Communicator

You can try replace function of eval for a single field

eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")

Else rex will solve your problem 100%

rex mode=sed "s/\"\"/\"/g"

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...