Splunk Search

What should I use to put a TAB literally in a regex replacement within transforms.conf?

stefan1988
Path Finder

What should I use to put a TAB literally in a regex replacement within transforms.conf?

I've tried \t but that's not working.

I would like to replace a | with tab (ASCI 0x09)

0 Karma

woodcock
Esteemed Legend

I cannot get escape codes (other than for captured field references) to work in the replace portion of sed inside of Splunk so I do not thing that this is possible without pre-processing with your own "glue" before coming into Splunk. I tried using \t and also \x09 and neither works.

0 Karma

malvidin
Communicator

For me, the only backslash sequences that worked for sed replacement were the newline (\n) and back references (\1, \2, etc.).

I think I'm going to have to put the replacement into an external lookup/command to include the ability to use other characters, like \r, \x0D, \t, or \x09.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi stefan1988,
are you sure that it's a TAB and not spaces?
Bye.
Giuseppe

0 Karma

stefan1988
Path Finder

Hi,

Yes I want to place a tab (ASCII 0x09).
\t seems not working.

Regards,
Stefan

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!