Search and Replace Text in SPL Fields with rex

[post-views]
January 02, 2025 · 1 min read
Search and Replace Text in SPL Fields with rex

Sometimes when working with fields in SPL, it can be useful to search for and replace parts of text found in the field. Some reasons for doing this might be:
– removing white space to reduce the size of the field
– replacing field separators with characters that look nicer
– rearranging values in a field in an order that is more appropriate (displaying names as first, last or last, first)

To replace text in a field, use the rex in sed mode using this syntax

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"

Was this article helpful?

Like and share it with your peers.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
Join for Free Book a Meeting

Related Posts

rare Сommand in Splunk
Blog, Knowledge Bits — 1 min read
rare Сommand in Splunk
Justin Erb
coalesce Function in Splunk
Blog, Knowledge Bits — 1 min read
coalesce Function in Splunk
Justin Erb
Using map Command in Splunk
Blog, Knowledge Bits — 3 min read
Using map Command in Splunk
Alex Verbniak