https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512276#M143671 <P>thank you!!! This worked<span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span><span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span></P> Tue, 04 Aug 2020 07:19:43 GMT priya0709 2020-08-04T07:19:43Z https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512201#M143638 <P>My query searches for (Eventcode=509 OR EventCode=118) and generates output (host, Time, EventCode, Task category, Mesaage)</P><P>Is it possible to use REPLACE to replace entire message field with another message associated with the EventCode??</P><P>&nbsp;</P> Mon, 03 Aug 2020 19:03:59 GMT https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512201#M143638 priya0709 2020-08-03T19:03:59Z https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512208#M143641 <P>Use some conditional logic combined with an eval to get it done&nbsp;</P><P>&nbsp;</P><P>| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)</P> Mon, 03 Aug 2020 19:34:40 GMT https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512208#M143641 skoelpin 2020-08-03T19:34:40Z https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512276#M143671 <P>thank you!!! This worked<span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span><span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span></P> Tue, 04 Aug 2020 07:19:43 GMT https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512276#M143671 priya0709 2020-08-04T07:19:43Z https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512284#M143672 <P>My query searches for eventcode and displays (host, time, task category, message) i want to use some color to highlight all &nbsp;same hosts generating multiple eventcode??</P><P>please help with the query</P><P>&nbsp;</P> Tue, 04 Aug 2020 07:23:43 GMT https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512284#M143672 priya0709 2020-08-04T07:23:43Z https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512383#M143706 <P>If my solution worked, can you accept it rather than your own?&nbsp;</P> Tue, 04 Aug 2020 14:08:59 GMT https://community.splunk.com/t5/Splunk-Search/Replace-string-to-replace-entire-Message-field-with-another/m-p/512383#M143706 skoelpin 2020-08-04T14:08:59Z