Splunk Search

Why is a function as 3-rd arg in the "replace" function not evaluating capturing groups?

philbond
Observer

Hi all,

Due to utf16/8-mismatch, I find a lot of utf16 \xnn chars in my events; this makes the json-parser  kind of losing it.

So I want to get the right utf8 chars out of a dictionary json-table by doing:

f=replace(_raw,"\\\\x([0-9a-fA-F]{2})",json_extract(utfx,"{}.\1"))

The dictionary simply looks like [{"00":"utf8char-1"}, ..., {"AE":"é"},...]

But this doesn't seem to work, the event even gets nilled completely.

Something explicit like this does seem to work though: (here for instance, all utf16 \xAE chars get replaced by the "é" char:
f=replace(_raw,"\\\\x([0-9a-fA-F]{2})",json_extract(utfx,"{}.9E"))

or this:

f=replace(_raw,"\\\\x([0-9a-fA-F]{2})","\1")), which simply removes the "\x"

...so is it like the capt.groups of the regex in replace() is not evaluated if it is arg to another function io a plain string?

Tx.

Labels (1)
0 Karma

philbond
Observer

..bump..

Anybody??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...