Search and Replace Text in SPL Fields with rex

Knowledge Bits

January 02, 2025

1 min read

Search and Replace Text in SPL Fields with rex

John Stevens
John Stevens linkedin icon Follow

Add to my AI research

ChatGPT icon Perplexity icon ClaudeAI icon Gemini icon

Subscribe to Weekly Digest

Exclusive to SOC Prime users

Newsletter Icon

Sometimes when working with fields in SPL, it can be useful to search for and replace parts of text found in the field. Some reasons for doing this might be:
– removing white space to reduce the size of the field
– replacing field separators with characters that look nicer
– rearranging values in a field in an order that is more appropriate (displaying names as first, last or last, first)

To replace text in a field, use the rex in sed mode using this syntax

| rex mode=sed field=<fieldname> "s/<whatyouwannachange>/<whatitshouldbeafterwards>/g"
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
Join for Free Book a Meeting

More Knowledge Bits Articles

rare Сommand in Splunk 1 min read Knowledge Bits rare Сommand in Splunk by Justin Erb coalesce Function in Splunk 1 min read Knowledge Bits coalesce Function in Splunk by Justin Erb Using map Command in Splunk 3 min read Knowledge Bits Using map Command in Splunk by Alex Verbniak