topic Re: replace String issue in Splunk Search

replace String issue

maxmukimov — Mon, 06 Jul 2020 16:08:18 GMT

Hello!
I’m trying to replace product codes with product names like
| replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon”
I’m getting what I want except when there are more than one value in Product code field.
Apple
Grape
A1 | A2
How can I fix the row with multiple values?
Thank you.

Re: replace String issue

efavreau — Mon, 06 Jul 2020 16:15:37 GMT

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

Re: replace String issue

maxmukimov — Mon, 06 Jul 2020 17:50:44 GMT

Thank you @efavreau !

I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why

|replace “A1” with “Apple”

wasn’t recognizing “A1 | A2”, what I did was, I added

| eval product=split(product, “ | “)

And now I’m getting the result I wanted.

Apple
Grape
Apple Grape

Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question.

Thank you again!