Splunk Search

What is the regular expression to replace a dash '-' in a string with a period '.'

shivac
New Member

12-000-000-222

for the above IP address, i want to change it to 12.000.000.222. pls help.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@shivac - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

somesoni2
Revered Legend

FYI, Options, other than sed are,

....| eval YourIPField=replace(YourIPField,"-",".")

not so good method

...| replace"*-*-*-*" with "*.*.*.*" in YourIPField
0 Karma

vasanthmss
Motivator

Try this,

your base search .. | rex mode=sed field=<your_field> "s/-/./g"

Sample:

|stats c | eval field="12-000-000-222" | table field | rex mode=sed field=field "s/-/./g"

V

cpetterborg
SplunkTrust
SplunkTrust

the sedcmd syntax is:

s/-/./g

Will that work for you?

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...