Splunk Search

how to replace using SED command ?

m7787580
Explorer

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

Tags (3)
1 Solution

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

View solution in original post

horsefez
Motivator

you can display html codes by clicking the 101010 button and entering your text there

0 Karma

horsefez
Motivator

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.
alt text

0 Karma

m7787580
Explorer

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂

0 Karma

m7787580
Explorer

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

0 Karma

horsefez
Motivator

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

horsefez
Motivator

you can substitute the _raw field with whatever field you use

0 Karma

m7787580
Explorer

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...