topic Re: rename & replace in Splunk Search

rename & replace

Lynda_Sadi1275 — Fri, 13 Jul 2018 11:53:13 GMT

Hello,

I'm new with SPL and Splunk, I have a folder that has 3 files, in the first file I have a column called Vblock, in the other two is called vCenter. I want to rename vCenter by Vblock in both files and then I want to replace the Vblock values as follows: when I have Vbc1 I replace it with Vblock1, when I have Vbc2 I replace it with Vblock 2, as I can do that?
I made this request |rename vCenter as Vblock |replace "vbc1" with "Vblock1", "vbc2" with "Vblock2" in Vblock but they do not replace the values of Vblock or I may not know how to check.

Thanks for your help.

Re: rename & replace

thambisetty — Fri, 13 Jul 2018 12:36:24 GMT

Hi,

You can do something like below,

| eval newfield=colesce(Vblock,vCenter)
| eval newfield=Case(newfield="Vbc1","vblock1",newfield="vbc2","vblock2")

Re: rename & replace

Lynda_Sadi1275 — Fri, 13 Jul 2018 13:17:52 GMT

What does the coalesce command mean in this Splunk search?

Re: rename & replace

somesoni2 — Fri, 13 Jul 2018 14:41:23 GMT

See these:
https://answers.splunk.com/answers/476830/what-does-the-coalesce-command-mean-in-this-splunk.html
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/CommonEvalFunctions#Supported_functions_and_syntax

Re: rename & replace

Lynda_Sadi1275 — Fri, 13 Jul 2018 16:15:10 GMT

what is the role of the order coalesce

Re: rename & replace

woodcock — Sun, 15 Jul 2018 16:55:26 GMT

The rename command changes the field name whereas replace changes the field value so you have that part right. You just need some wildcards:

 |rename vCenter as Vblock |replace "*vbc1*" with "*Vblock1*", "*vbc2*" with "*Vblock2*" in Vblock