https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471564#M30939 <P>Try rex to change replace special characters with space</P> <PRE><CODE>| makeresults | eval data="James:bond;sharma" | rex field=data mode=sed "s/(\w+)(:)(\w+)(;)(\w+)/\1 \3 \5/" </CODE></PRE> Wed, 04 Sep 2019 17:16:10 GMT mayurr98 2019-09-04T17:16:10Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471563#M30938 <P>I am looking for replacing "James:bond;sharma" with "James bond sharma"in text box in dashboard.</P> <PRE><CODE>index=* sourcetype=* $Pattern$ </CODE></PRE> <P>The pattern is the token value for the Text box in Splunk Dashboard.<BR /> I want to replace all the special characters with space in token value while searching, as I don't want to search for special characters even if it is provided in text box in Splunk dashboard.</P> Wed, 04 Sep 2019 17:02:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471563#M30938 shraysharma88 2019-09-04T17:02:37Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471564#M30939 <P>Try rex to change replace special characters with space</P> <PRE><CODE>| makeresults | eval data="James:bond;sharma" | rex field=data mode=sed "s/(\w+)(:)(\w+)(;)(\w+)/\1 \3 \5/" </CODE></PRE> Wed, 04 Sep 2019 17:16:10 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471564#M30939 mayurr98 2019-09-04T17:16:10Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471565#M30940 <P>James:bond;sharma is the input I have given in text box in dashboard.<BR /> And data in text box can be any thing like ram$shyam%hari.<BR /> I want to replace every special character with space.</P> <P>Below is the search query for panel -: </P> <P>index=* sourcetype=* $Pattern$</P> <P>where Pattern is the token value used for text box in panel of dashboard </P> Wed, 04 Sep 2019 17:27:58 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471565#M30940 shraysharma88 2019-09-04T17:27:58Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471566#M30941 <P>try this then </P> <P><CODE>| rex field=data mode=sed "s/(\w+)([^\w]+)(\w+)([^\w]+)(\w+)/\1 \3 \5/"</CODE><BR /> this will replace any special character with space</P> Wed, 04 Sep 2019 17:37:24 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471566#M30941 mayurr98 2019-09-04T17:37:24Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471567#M30942 <P>Here's one way you can do it:</P> <PRE><CODE>| eval data=replace(data,"\W"," ") | eval data=replace(data,"\ {2,}"," ") </CODE></PRE> <P>That will remove any non-word characters, swapping for a space. Then replace any sequential spaces with a single space.</P> Wed, 04 Sep 2019 17:51:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471567#M30942 wmyersas 2019-09-04T17:51:09Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471568#M30943 <P>index=TEST1 sourcetype=TEST2 |eval Patterns="VNRDUS33_:" | eval Pattern1 = upper(replace(Patterns,"([-:._])"," "))| return Pattern1 | search Pattern1</P> <P>I am facing issue while trying to search the pattern now.<BR /> Replace is working as expected.</P> Wed, 30 Sep 2020 02:03:58 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471568#M30943 shraysharma88 2020-09-30T02:03:58Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471569#M30944 <P>What are you using <CODE>return</CODE> for here? </P> Thu, 05 Sep 2019 13:33:30 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-replace-the-special-characters-with-Space-in-text-field/m-p/471569#M30944 wmyersas 2019-09-05T13:33:30Z