Splunk Search

how to add Attributes with a Regular Expression

bigbeetlefan
Explorer

Hi Gurus,

I have a index, and the data was in one column is like

Item__bAffected, I'd like to replace "__b" with a " "(space), so it will look like

"Item Affected"

however, I don't know how to used regular expression to replace the string, or its more easier to filter them out before input in to index?

any idea?

THanK you.

Tags (2)
0 Karma

somesoni2
Revered Legend

The rex command does the replacement at search time only (its not a permanent change to data stored). You need to include the rex part in each of the query your use for your chart/table etc.

0 Karma

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi bigbeetlefan,

you can do this with rex like this:

... | rex mode=sed field=YourField "s/__b/ /g" | ...

cheers, MuS

bigbeetlefan
Explorer

Thanks MuS, that works perfect in the search, however, do you know how to replace it in the label?

I tried above, it works ok in raw data, but when put it into a table format, it still shows the name with __b in it. same to the chart, if I build a chart, the label still shows the unformated text, any idea how should I get this one done?

Cheers

0 Karma
Get Updates on the Splunk Community!

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

Unlock Instant Security Insights from Amazon S3 with Splunk Cloud — Try Federated ...

Availability: Must be on Splunk Cloud Platform version 10.1.2507.x to view the free trial banner. If you are ...