Splunk Search
Highlighted

i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g "

Builder

Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified

0 Karma
Highlighted

Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g "

Path Finder

Can you provide a sample, what the event is and what you want to extract out of that event ?

0 Karma
Highlighted

Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g "

Builder

i want to cut\remove all the character when "Modified" is Present.

EX : Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified

0 Karma
Highlighted

Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g "

Path Finder

So if there is field A . When word "Modified" in NOT present in the event, value of A="Add" and when word "Modified" is present is the event, value of A="-" . Is this what you want ?

0 Karma
Highlighted

Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g "

Esteemed Legend

Like this:

| rex field=ER mode=sed "s/Modified\S+.*$//g "

But maybe the \S should be \s so try this if that doesn't work:

| rex field=ER mode=sed "s/Modified\s+.*$//g "

Or maybe actually this:

| rex field=ER mode=sed "s/Modified:\s+.*$//g "

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.