Rex mode=sed to substitute < & > with nothing?

[LHumberto]

Greetings!

The target filed is message_id and sometimes the field value comes with brackets <b8047a671f47430cb44afbf14d332c63@domain.com> and sometimes it doesn't b8047a671f47430cb44afbf14d332c63@domain.com.

I'm trying to used rex mode=sed to replace < & > with nothing (effectively removing the brackets), so that field can be later used in a deduplication process (outside Splunk).  but I can't get it to work.

I tried using is rex field=message_id mode=sed "s/&lt;&gt;//g" but no substitution occurs. While rex field=message_id mode=sed "y/&lt;&gt;//g" throws an error "Error in 'rex' command: Failed to initialize sed. '&lt;&gt;' and '' are different length."

What gives?

[scelikok]

Hi @LHumberto,

This should work;

| rex field=message_id mode=sed "s/<|>//g"