Splunk Search

how to add Attributes with a Regular Expression

Explorer

Hi Gurus,

I have a index, and the data was in one column is like

Item__bAffected, I'd like to replace "__b" with a " "(space), so it will look like

"Item Affected"

however, I don't know how to used regular expression to replace the string, or its more easier to filter them out before input in to index?

any idea?

THanK you.

Tags (2)
0 Karma

Revered Legend

The rex command does the replacement at search time only (its not a permanent change to data stored). You need to include the rex part in each of the query your use for your chart/table etc.

0 Karma

Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma

SplunkTrust
SplunkTrust

Hi bigbeetlefan,

you can do this with rex like this:

... | rex mode=sed field=YourField "s/__b/ /g" | ...

cheers, MuS

Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!