Is there a cribl equivalent to Splunk’s rex mode=sed?
Is there a cribl equivalent to Splunk’s rex mode=sed? I’ve tried replace_regex but I kept hitting a brick wall.
I’m trying to take a timestamp with an indeterminate number of spaces and replace those spaces with a single space in a pipeline (using ‘eval’ function)
Data looks like this:
timestamp: “2023-10-03 09:29:00”
Currently I’ve done the really hacky fix of extracting both the date and time and smooshing them together (eval date + ’ ' time)