writing rex command in transforms

abhayneilam · ‎11-04-2012

Hi,

I want to write "rex mode=sed field="DIRECTORY" "s/|/ |/g" in transforms.conf or props.conf so that the replacement happens before importing the file in the splunk . Is it possible please let me know how it could be achieved

Thanks in advance

gkanapathy · ‎11-04-2012

You can probably look at the documentation for http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf in particular, SEDCMD.

writing rex command in transforms

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Management Digest – August 2026

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Join the Conversation

writing rex command in transforms

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Management Digest – August 2026

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM