Splunk Search

Rex mode=sed to substitute < & > with nothing?

LHumberto
Explorer

Greetings!

The target filed is message_id and sometimes the field value comes with brackets <b8047a671f47430cb44afbf14d332c63@domain.com> and sometimes it doesn't b8047a671f47430cb44afbf14d332c63@domain.com.

I'm trying to used rex mode=sed to replace < & > with nothing (effectively removing the brackets), so that field can be later used in a deduplication process (outside Splunk).  but I can't get it to work.

I tried using is rex field=message_id mode=sed "s/&lt;&gt;//g" but no substitution occurs. While rex field=message_id mode=sed "y/&lt;&gt;//g" throws an error "Error in 'rex' command: Failed to initialize sed. '&lt;&gt;' and '' are different length."

 

What gives?

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @LHumberto,

This should work;

| rex field=message_id mode=sed "s/<|>//g"
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...