Splunk Search

having a doubt in splunk query

Chandrasekhar6
Explorer
I want to change the msg for a log i.e

<list >
<Header>.....</Header>
<status>
<Message>Thuihhh_4y3y27y234yy4 is pending</Message>
</status>
</list>

to

<list >
<Header>.....</Header>
<status>
<Message>request is pending</Message>
</status>
</list>
 
how can i achieve using rex+sed commands in splunk
Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

While @bowesmana 's solution should work be aware that working with structured data using just regexes can lead to unforeseen problems.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

| rex mode=sed "s/(<Message>).*( is pending)(<\/Message>)/\1request\2\3/"

 

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...