writing rex command in transforms

abhayneilam · ‎11-04-2012

Hi,

I want to write "rex mode=sed field="DIRECTORY" "s/|/ |/g" in transforms.conf or props.conf so that the replacement happens before importing the file in the splunk . Is it possible please let me know how it could be achieved

Thanks in advance

gkanapathy · ‎11-04-2012

You can probably look at the documentation for http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf in particular, SEDCMD.

writing rex command in transforms

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

writing rex command in transforms

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience