Splunk Search

how to add Attributes with a Regular Expression

bigbeetlefan
Explorer

Hi Gurus,

I have a index, and the data was in one column is like

Item__bAffected, I'd like to replace "__b" with a " "(space), so it will look like

"Item Affected"

however, I don't know how to used regular expression to replace the string, or its more easier to filter them out before input in to index?

any idea?

THanK you.

Tags (2)
0 Karma

somesoni2
Revered Legend

The rex command does the replacement at search time only (its not a permanent change to data stored). You need to include the rex part in each of the query your use for your chart/table etc.

0 Karma

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi bigbeetlefan,

you can do this with rex like this:

... | rex mode=sed field=YourField "s/__b/ /g" | ...

cheers, MuS

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...