Skip to main content
Solved

Is there a cribl equivalent to Splunk’s rex mode=sed?

  • March 11, 2025
  • 1 reply
  • 4 views

Hi all,
Is there a cribl equivalent to Splunk’s rex mode=sed? I’ve tried replace_regex but I kept hitting a brick wall.

I’m trying to take a timestamp with an indeterminate number of spaces and replace those spaces with a single space in a pipeline (using ‘eval’ function)

Data looks like this:
timestamp: “2023-10-03     09:29:00”

Currently I’ve done the really hacky fix of extracting both the date and time and smooshing them together (eval date + ’ ' time)

Thanks!

Best answer by David Maislin

timestamp.replace(/\s+/g,' ')

Mask function is similar:Left side: \s+ optional global flag
Right side: ' '

1 reply

  • Employee
  • 228 replies
  • Answer
  • March 11, 2025

timestamp.replace(/\s+/g,' ')

Mask function is similar:Left side: \s+ optional global flag
Right side: ' '