Splunk Search

having a doubt in splunk query

Chandrasekhar6
Explorer
I want to change the msg for a log i.e

<list >
<Header>.....</Header>
<status>
<Message>Thuihhh_4y3y27y234yy4 is pending</Message>
</status>
</list>

to

<list >
<Header>.....</Header>
<status>
<Message>request is pending</Message>
</status>
</list>
 
how can i achieve using rex+sed commands in splunk
Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While @bowesmana 's solution should work be aware that working with structured data using just regexes can lead to unforeseen problems.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

| rex mode=sed "s/(<Message>).*( is pending)(<\/Message>)/\1request\2\3/"

 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...