Splunk Search

how to add Attributes with a Regular Expression

bigbeetlefan
Explorer

Hi Gurus,

I have a index, and the data was in one column is like

Item__bAffected, I'd like to replace "__b" with a " "(space), so it will look like

"Item Affected"

however, I don't know how to used regular expression to replace the string, or its more easier to filter them out before input in to index?

any idea?

THanK you.

Tags (2)
0 Karma

somesoni2
Revered Legend

The rex command does the replacement at search time only (its not a permanent change to data stored). You need to include the rex part in each of the query your use for your chart/table etc.

0 Karma

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma

MuS
Legend

Hi bigbeetlefan,

you can do this with rex like this:

... | rex mode=sed field=YourField "s/__b/ /g" | ...

cheers, MuS

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...