Splunk Search

What should I use to put a TAB literally in a regex replacement within transforms.conf?

stefan1988
Path Finder

What should I use to put a TAB literally in a regex replacement within transforms.conf?

I've tried \t but that's not working.

I would like to replace a | with tab (ASCI 0x09)

0 Karma

woodcock
Esteemed Legend

I cannot get escape codes (other than for captured field references) to work in the replace portion of sed inside of Splunk so I do not thing that this is possible without pre-processing with your own "glue" before coming into Splunk. I tried using \t and also \x09 and neither works.

0 Karma

malvidin
Communicator

For me, the only backslash sequences that worked for sed replacement were the newline (\n) and back references (\1, \2, etc.).

I think I'm going to have to put the replacement into an external lookup/command to include the ability to use other characters, like \r, \x0D, \t, or \x09.

0 Karma

gcusello
Legend

Hi stefan1988,
are you sure that it's a TAB and not spaces?
Bye.
Giuseppe

0 Karma

stefan1988
Path Finder

Hi,

Yes I want to place a tab (ASCII 0x09).
\t seems not working.

Regards,
Stefan

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>