What are the differences between option "s" and "y"?
index=_internal sourcetype=splunkd | rex mode=sed “s/idx=\d+\.\d+\.\d+\.\d+\:\d+/XX.XXX.XX.XXX:XXXX/g" index=_internal sourcetype=splunkd | rex mode=sed "y/127.0.0.1:9997/XXX.X.X.X:XXXX/"
I can find all the logs with "Connected to blah blah" and replace the ip and port with something in both ways. Besides the fact that the substitute option will only grab the exact ip of "127.0.0.1", what are the major differences between these 2 options?
If you're familiar with the traditional unix commands
tr, the difference is that one is
sed-like and the other is
If you have an event of the form:
06/10/2014 00:05:00 myapp does super-awesome-things for user=bobbychuck
| rex mode=sed "s/awesome/terrible/"
will cause it to say:
06/10/2014 00:05:00 myapp does super-terrible-things for user=bobbychuck
| rex mode=sed "y/abc/xyz/"
06/10/2014 00:05:00 myxpp does super-xwesome-things for user=yoyyyzhuzk
Yeah, the idea of
s/xxx/yyy/ is fundamentally search-and-replace string-for-string while
y/abc/xyz/ is "replace every a with x, every b with y, and every c with z." Both are useful but for different situations.