topic Re: replacing values with "*****" in Splunk Search

replacing values with "*****"

hurryupfool123 — Tue, 27 Oct 2020 17:09:25 GMT

I have a field "users" that spits out the result "*****"

I want to replace the ***** with an IP address its actually related to... i.e.

replace ***** with (12.13.12.13). so that when ever ****** pops up on my table its replaced with the IP's above.

but everytime I search I get a failure stating I can't use consecutive ******

|replace "*****" with (12.13.12.13)

how can I literally reference ***** as a strings instead of SPL thinking I am saying to search anything bc of the ******

isoutamo — Tue, 27 Oct 2020 17:24:08 GMT

Please try to escape every * with \. Basically that means “\*\*\*\*\*”. Some cases you must use more than one \ to escape character.
r. Ismo

hurryupfool123 — Tue, 27 Oct 2020 18:20:56 GMT

thank you! don't know why I didn't think of that!