What should I use to put a TAB literally in a regex replacement within transforms.conf?
I've tried \t but that's not working.
I would like to replace a | with tab (ASCI 0x09)
I cannot get escape codes (other than for captured field references) to work in the replace
portion of sed
inside of Splunk so I do not thing that this is possible without pre-processing with your own "glue" before coming into Splunk. I tried using \t
and also \x09
and neither works.
For me, the only backslash sequences that worked for sed replacement were the newline (\n) and back references (\1, \2, etc.).
I think I'm going to have to put the replacement into an external lookup/command to include the ability to use other characters, like \r, \x0D, \t, or \x09.
Hi stefan1988,
are you sure that it's a TAB and not spaces?
Bye.
Giuseppe
Hi,
Yes I want to place a tab (ASCII 0x09).
\t seems not working.
Regards,
Stefan