https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537837#M152058 <P>Hi All,</P><P>I have field called stepName which will have below three values.</P><P>TextResource.getFirstLine</P><P>TextResource.getSecondLine</P><P>TextResource.getLastLine</P><P>How can write a rex with mode=sed to replace only the words First,Second and Last from the stepName field to "Which", so that my output will have only one stepName field value as "TextResource.getWhichLine".</P><P>&nbsp;</P> Fri, 29 Jan 2021 13:36:08 GMT viswatejabolla 2021-01-29T13:36:08Z https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537837#M152058 <P>Hi All,</P><P>I have field called stepName which will have below three values.</P><P>TextResource.getFirstLine</P><P>TextResource.getSecondLine</P><P>TextResource.getLastLine</P><P>How can write a rex with mode=sed to replace only the words First,Second and Last from the stepName field to "Which", so that my output will have only one stepName field value as "TextResource.getWhichLine".</P><P>&nbsp;</P> Fri, 29 Jan 2021 13:36:08 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537837#M152058 viswatejabolla 2021-01-29T13:36:08Z https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537840#M152060 <P>This should do it.</P><LI-CODE lang="markup">| rex field=stepName mode=sed "s/(First|Second|Last)/Which/"</LI-CODE> Fri, 29 Jan 2021 13:52:42 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537840#M152060 richgalloway 2021-01-29T13:52:42Z https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537862#M152064 <P><SPAN>Hi Rich,</SPAN></P><P>Thanks for responding. Those are not the only three which I have. There are some other stepNames as well which have same starting string and ending string. Adding all of those words to the search string will make it ugly.</P><P>Anything can be done like "startswith" and "endwith", or by a regex which can do this without giving all the words.</P> Fri, 29 Jan 2021 14:49:15 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537862#M152064 viswatejabolla 2021-01-29T14:49:15Z https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537869#M152066 <LI-CODE lang="markup">| rex field=data mode=sed "s/(TextResource\.get).*(Line)/\1Which\2/"</LI-CODE> Fri, 29 Jan 2021 15:59:04 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-multiple-values-of-a-field-with-single-value-with-rex/m-p/537869#M152066 richgalloway 2021-01-29T15:59:04Z