Replacing commas with another character for part of _raw

[danielbb]

Within _raw we have this segment -

SQL_TEXT="grant create database link to aaa01, bbb02, yyy03, xxx04",

We would like to replace only the commas in this part of _raw with dollar signs. Is it possible?

[kamlesh_vaghela]

@danielbb 

You can try something like this using rex command.

YOUR_SEARCH
| rex mode=sed field=_raw "s/(,(?=[^\"]*\"[^\"]*(?:\"[^\"]*\"[^\"]*)*$))/$/g"

Sample Code:

| makeresults 
| eval _raw="SQL_TEXT=\"grant create database link to aaa01, bbb02, yyy03, xxx04\", mmmm, " 
| rex mode=sed field=_raw "s/(,(?=[^\"]*\"[^\"]*(?:\"[^\"]*\"[^\"]*)*$))/$/g"

[s2_splunk]

You mean modifying _raw before it is being indexed? Or while searching?

[danielbb]

While searching would be great.

One way, to do it, might be to split _raw to three segments -

(?<part1>.*)(?<part2>SQL_TEXT=".+?")(?<part3>.*)

Then replace commas in part2 with a dollar sign and then concatenate the three segments. Does it make sense?

[s2_splunk]

Here's the simple way to do this in search. You cannot modify _raw as indexed,  but you could certainly do it as you outline for the current search. This run anywhere example assumes shows using the replace function to do the character substitution:

| makeresults 
| eval _raw="<some, other, text> SQL_TEXT=\"grant create database link to aaa01, bbb02, yyy03, xxx04\", <more,other,text>" 
| rex field=_raw "SQL_TEXT=\"(?<sqltxt>.*)\"" 
| eval newsqltext=replace(sqltxt,",","$")

Depending on how you have this datasource configured, you may already have a field called SQL_TEXT extracted, so you may not have to do the rex at all.

Here's how you could do it following your approach: 

| makeresults 
| eval _raw="<some, other, text> SQL_TEXT=\"grant create database link to aaa01, bbb02, yyy03, xxx04\", <more,other,text>" 
| rex field=_raw "^(?<prefix>.+)SQL_TEXT=\"(?<sqltxt>.*)\"(?<suffix>.+)$" 
| eval new_raw = prefix+"SQL_TEXT="+replace(sqltxt,",","$")+suffix 
| fields _raw, new_raw

HTH