Splunk Search

Replace string

Communicator

I want to replace (" ") in my xml file to single (").Since there is some misplace of double codes in my whole file.So please help
<?xml version=""1.0"" encoding=""ISO-9000-1"" ?>

Tags (1)

Communicator

try:

yoursearch | rex mode=sed "s/\"\"/\"/g"

Communicator

Thanks gooza.its working

0 Karma

New Member

works for me as well

0 Karma

Contributor

I had to add the field name to make mine work:
(replacing + with a space in my case)

rex mode=sed field=search_term_used "s/+/ /g"

Also, in my case I had to escape the +

weird, when I post this comment, the rex line looses the escape character .

0 Karma

Engager

Have you tried to open the xml file with an editor, most of them have a find an replace function.

0 Karma

Communicator

I should not replace any values manually in the file.I meant i want to replace that double codes during time of search only since it should not make any permanent change in xml file.Can u suggest any search query for that

0 Karma

Communicator

You can try replace function of eval for a single field

eval n=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")

Else rex will solve your problem 100%

rex mode=sed "s/\"\"/\"/g"

0 Karma