Splunk Search

rex mode=sed syntax

cschafer1
New Member

I apolagize for the simplicity of this question. I have scowered all over splunk answers and could find or make sense of a solutions from what I have found.

I need to remove %20 from my search and replace with a space. I have tried:

rex mode=sed "s/%20/ /"
rex mode=sed "s/%20/ /g"
rex mode=sed field=fieldname "s/%20/ /g"

I am sure it is not registering with me whith the slashes what is needed in the sed sytax.

Thank you for any assistance.

Cory

Tags (1)
0 Karma
1 Solution

Ayn
Legend

That's really how you would do it with rex mode=sed so I really don't know why it's not working for you. However I suggest an alternate solution that seems more appropriate in your scenario anyway: use eval's urldecode function instead. It will read a string, decode all URL encoded entities and return the decoded string.

... | eval yourfield=urldecode(yourfield)

View solution in original post

Ayn
Legend

That's really how you would do it with rex mode=sed so I really don't know why it's not working for you. However I suggest an alternate solution that seems more appropriate in your scenario anyway: use eval's urldecode function instead. It will read a string, decode all URL encoded entities and return the decoded string.

... | eval yourfield=urldecode(yourfield)

Ayn
Legend

Awesome. Could you please mark my answer as accepted (click the tick mark on the left)? Thanks!

0 Karma

cschafer1
New Member

That worked... Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...