Splunk Search
Highlighted

how to replace using SED command ?

Explorer

Hi Splunker,

I would like to know and learn how to replace ^ns4: with <

Please find below dummy data.

^ns4:ChannelName>PublicSales
^ns4:Result>SUCCESS^/ns4:Result>

Probably here HTML tags are not visible therefore not able to provide you the exact information.

Thanks in advance

Tags (3)
Highlighted

Re: how to replace using SED command ?

SplunkTrust
SplunkTrust

Hi,

the syntax for this is:

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Your solution:

| rex mode=sed field=_raw "s/\^ns4\:/\</g"

View solution in original post

Highlighted

Re: how to replace using SED command ?

SplunkTrust
SplunkTrust

you can substitute the _raw field with whatever field you use

0 Karma
Highlighted

Re: how to replace using SED command ?

Explorer

Thanks a lot

0 Karma
Highlighted

Re: how to replace using SED command ?

SplunkTrust
SplunkTrust

you can display html codes by clicking the 101010 button and entering your text there

0 Karma
Highlighted

Re: how to replace using SED command ?

Explorer

Hi Pyro_wood,

What is 101010.
I am not able to understand.

Thanks in advance

0 Karma
Highlighted

Re: how to replace using SED command ?

SplunkTrust
SplunkTrust

Hi,

its a button that opens up a form. This will allow you to fill in code without having trouble when it comes to formatting issues or html tags.

Take a look at this picture, this should look familliar.
alt text

0 Karma
Highlighted

Re: how to replace using SED command ?

Explorer

Thanks a ton
Got it ,it was a bit lazy stuff by me 🙂

0 Karma