Splunk Search

how to replace using SED command ?

m7787580
Explorer

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

Tags (3)
1 Solution

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

View solution in original post

horsefez
Motivator

you can display html codes by clicking the 101010 button and entering your text there

0 Karma

horsefez
Motivator

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.
alt text

0 Karma

m7787580
Explorer

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂

0 Karma

m7787580
Explorer

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

0 Karma

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

horsefez
Motivator

you can substitute the _raw field with whatever field you use

0 Karma

m7787580
Explorer

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...