Splunk Search

how to replace using SED command ?

m7787580
Explorer

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

Tags (3)
1 Solution

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

View solution in original post

horsefez
Motivator

you can display html codes by clicking the 101010 button and entering your text there

0 Karma

horsefez
Motivator

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.
alt text

0 Karma

m7787580
Explorer

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂

0 Karma

m7787580
Explorer

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

0 Karma

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

horsefez
Motivator

you can substitute the _raw field with whatever field you use

0 Karma

m7787580
Explorer

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...