Splunk Search

Rex mode=sed diff between replace and substitute

ben_leung
Builder

What are the differences between option "s" and "y"?

index=_internal sourcetype=splunkd  | rex mode=sed “s/idx=\d+\.\d+\.\d+\.\d+\:\d+/XX.XXX.XX.XXX:XXXX/g"

index=_internal sourcetype=splunkd  | rex mode=sed "y/127.0.0.1:9997/XXX.X.X.X:XXXX/"

I can find all the logs with "Connected to blah blah" and replace the ip and port with something in both ways. Besides the fact that the substitute option will only grab the exact ip of "127.0.0.1", what are the major differences between these 2 options?

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Rex

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

If you're familiar with the traditional unix commands sed and tr, the difference is that one is sed-like and the other is tr-like.

If you have an event of the form:

06/10/2014 00:05:00 myapp does super-awesome-things for user=bobbychuck

Then

| rex mode=sed "s/awesome/terrible/"

will cause it to say:

06/10/2014 00:05:00 myapp does super-terrible-things for user=bobbychuck

But

| rex mode=sed "y/abc/xyz/"

will cause:

06/10/2014 00:05:00 myxpp does super-xwesome-things for user=yoyyyzhuzk

View solution in original post

vijaysubramania
Path Finder

Thanks Dwaddle!

0 Karma

dwaddle
SplunkTrust
SplunkTrust

If you're familiar with the traditional unix commands sed and tr, the difference is that one is sed-like and the other is tr-like.

If you have an event of the form:

06/10/2014 00:05:00 myapp does super-awesome-things for user=bobbychuck

Then

| rex mode=sed "s/awesome/terrible/"

will cause it to say:

06/10/2014 00:05:00 myapp does super-terrible-things for user=bobbychuck

But

| rex mode=sed "y/abc/xyz/"

will cause:

06/10/2014 00:05:00 myxpp does super-xwesome-things for user=yoyyyzhuzk

dwaddle
SplunkTrust
SplunkTrust

Yeah, the idea of s/xxx/yyy/ is fundamentally search-and-replace string-for-string while y/abc/xyz/ is "replace every a with x, every b with y, and every c with z." Both are useful but for different situations.

ben_leung
Builder

Thanks for responding dwaddle. I did not notice that the new characters match with the original ones.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...