Splunk Search

rex in sed mode to replace special chartacter

Communicator

Good morning
I need to replace special characters with a line return command but I am having difficulty getting the rex mode=sed working correctly -

example foo fields

hr$D362$processing
long$trip

| rex field=foo mode=sed "s/(".+?$.+?")/\n/g"

Many thanks for any help you could provide

0 Karma

Ultra Champion
| makeresults
| eval _raw="hr$D362$processing"
| appendpipe
    [eval _raw="long$trip"]
    | eval foo=split(_raw,"$")

Hi, folks.
Simply, use split()

0 Karma

Ultra Champion
index=foobar 
| eval s1= section.";".Name.";".Code 
| eval s2=crit.";".critname 
| stats values(Number) as Number by s2 s1 
| eval s2 = split(s2,";"), s1 = split(s1,";") 
| chart values(Number) as Number over s2 by s1 useother=f usenull=f

Here is for search query.
I see the multiple values ​​are automatically expanded.
great!

0 Karma

SplunkTrust
SplunkTrust

@ChrisCLewis

Can you please try this rex command?
| rex field=foo mode=sed "s/\$/\n/g"

Sample Search:

| makeresults | eval foo="hr$D362$processing" | rex field=foo mode=sed "s/\$/\n/g"
0 Karma

Communicator

Good afternoon,

thank you for your reply.

It is changing the $ to a space rather than a line return
showing
hr D362 processing

hoping for:
hr
D362
processing

Regards

0 Karma

SplunkTrust
SplunkTrust

It's working for me. Please check. https://imgur.com/a/q0w7ZjL

Can you please share your full search with masking confidential values?

0 Karma

Communicator

index=foobar
|eval s1= section.";".Name.";".Code
|eval s2=crit.";".critname

|stats values(Number) as Number by s2 s1
| rex field=s2 mode=sed "s/\;/\n/g"
| rex field=s1 mode=sed "s/\;/\n/g"
|chart values(Number) over sepa2 by sepa useother=f usenull=f

Interestingly when I 'inspect' the graph it looks like there is a line break but splunk is showing it as a space in the chart

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!