topic Re: How to replace a character with blank/space value? in Splunk Search

How to replace a character with blank/space value?

zacksoft — Tue, 18 Sep 2018 10:19:43 GMT

My field name is 'fileName' and the values it contains are like this:

PVOLFEPCL-00515+Berger+Profile+Settings.docx
Intake3++B2N+Lan+07492018.xlsm

I want it to be like this,

PVOLFEPCL-00515 Berger Profile Settings.docx
Intake3 B2N Lan 07492018.xlsm

The ''+" has to be replaced by Space .

I tried the following , but it doesn't work:

host="*evilcorp*.fantasy.com" "affirative"
| rex field=_raw "^[^&\n]*&\w+=(?P<fileName>[^ ]+)(?:[^ \n]* ){3}(?P<ttr>.+)" 
| table userid fileName ttr 
 | replace "+" WITH "" IN fileName

Re: How to replace a character with blank/space value?

harishalipaka — Tue, 18 Sep 2018 11:32:38 GMT

hi @zacksoft

try this |makeresults |eval hari="Intake3++B2N+Lan+07492018.xlsm" |table hari | rex field=hari mode=sed "s/\+/ /g"

if it is helped accept as answer

Re: How to replace a character with blank/space value?

harsmarvania57 — Tue, 18 Sep 2018 13:28:40 GMT

Hi @zacksoft,

Please try below query.

<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"

Here is run anywhere search which is generating correct ouput

| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"