I have some data that is displaying line breaks as "\n". I'm having problems writing rex commands in searches to strip those out. For example, I have the following:
Linux Kernel 2.4\nLinux Kernel 2.6\n
I would like rex to return:
Linux Kernel 2.4
I've tried things like [\w\s\d.()-\,]+ and [^\]+. I've tried putting (\n) and (\\n) after the (?P<...>) field extraction.
Sorry to be so noobish.
If you're doing it at search time using rex in the SplunkWeb interface, you need to quote the
You would not need to do this nested quoting in a config file. You would probably need to do it in the Unix shell, though you might quote it differently. On the standard Windows cmd shell, the quoting rules are unclear, but you probably don't need to quote