Splunk Search

SEDCMD: How to change the format of my data collection?

khyoung7410
Communicator

Hi

The format of my data collection is as follows.

There are a total of 29 letters and numbers.

* Sample data
D0064659949080052811436122722

Can I replace the 13th to 25th digit with a space in these data?

This is the type of data I want:

<pre>D00646599490             2722</pre>

Thank you

Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

View solution in original post

0 Karma

FrankVl
Ultra Champion

Sure, I think the following should work: SEDCMD = s/(.{12}).{13}(.*)/\1 \2/g

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...