Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: rex mode=sed syntax
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I apolagize for the simplicity of this question. I have scowered all over splunk answers and could find or make sense of a solutions from what I have found.
I need to remove %20 from my search and replace with a space. I have tried:
rex mode=sed "s/%20/ /"
rex mode=sed "s/%20/ /g"
rex mode=sed field=fieldname "s/%20/ /g"
I am sure it is not registering with me whith the slashes what is needed in the sed sytax.
Thank you for any assistance.
Cory
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's really how you would do it with rex mode=sed so I really don't know why it's not working for you. However I suggest an alternate solution that seems more appropriate in your scenario anyway: use eval's urldecode function instead. It will read a string, decode all URL encoded entities and return the decoded string.
... | eval yourfield=urldecode(yourfield)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's really how you would do it with rex mode=sed so I really don't know why it's not working for you. However I suggest an alternate solution that seems more appropriate in your scenario anyway: use eval's urldecode function instead. It will read a string, decode all URL encoded entities and return the decoded string.
... | eval yourfield=urldecode(yourfield)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome. Could you please mark my answer as accepted (click the tick mark on the left)? Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked... Thank you very much.
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
