Splunk Search

rex in sed mode to replace special chartacter

ChrisCLewis
Communicator

Good morning
I need to replace special characters with a line return command but I am having difficulty getting the rex mode=sed working correctly -

example foo fields

hr$D362$processing
long$trip

| rex field=foo mode=sed "s/(".+?$.+?")/\n/g"

Many thanks for any help you could provide

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="hr$D362$processing"
| appendpipe
    [eval _raw="long$trip"]
    | eval foo=split(_raw,"$")

Hi, folks.
Simply, use split()

0 Karma

to4kawa
Ultra Champion
index=foobar 
| eval s1= section.";".Name.";".Code 
| eval s2=crit.";".critname 
| stats values(Number) as Number by s2 s1 
| eval s2 = split(s2,";"), s1 = split(s1,";") 
| chart values(Number) as Number over s2 by s1 useother=f usenull=f

Here is for search query.
I see the multiple values ​​are automatically expanded.
great!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ChrisCLewis

Can you please try this rex command?
| rex field=foo mode=sed "s/\$/\n/g"

Sample Search:

| makeresults | eval foo="hr$D362$processing" | rex field=foo mode=sed "s/\$/\n/g"
0 Karma

ChrisCLewis
Communicator

Good afternoon,

thank you for your reply.

It is changing the $ to a space rather than a line return
showing
hr D362 processing

hoping for:
hr
D362
processing

Regards

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

It's working for me. Please check. https://imgur.com/a/q0w7ZjL

Can you please share your full search with masking confidential values?

0 Karma

ChrisCLewis
Communicator

index=foobar
|eval s1= section.";".Name.";".Code
|eval s2=crit.";".critname

|stats values(Number) as Number by s2 s1
| rex field=s2 mode=sed "s/\;/\n/g"
| rex field=s1 mode=sed "s/\;/\n/g"
|chart values(Number) over sepa2 by sepa useother=f usenull=f

Interestingly when I 'inspect' the graph it looks like there is a line break but splunk is showing it as a space in the chart

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...