topic Re: How do you remove part of a field value? in Splunk Search

How do you remove part of a field value?

zikpefu — Wed, 18 Jul 2018 12:53:52 GMT

I am trying to remove the +'s in between words for my table (i.e. stainless+steel to be just stainless steel) and my field name is SearchTerm. I tried the eval replace command method but it keeps saying Regex quantifier does not follow repeatable item; I do not know what to do. Any help would be appreciated.

My eval command:

| eval SearchTerm=replace(SearchTerm,"+"," ")

Edit: Spelling

Re: How do you remove part of a field value?

renjith_nair — Wed, 18 Jul 2018 13:05:13 GMT

Hi @zikpefu

escape '+'

eval SearchTerm=replace(SearchTerm,"\+"," ")

Re: How do you remove part of a field value?

woodcock — Wed, 18 Jul 2018 13:12:08 GMT

You need to escape like this (because + is a special command character):

 | eval SearchTerm=replace(SearchTerm,"\+"," ")

I would do it like this:

| rex field=SearchTerm mode=sed "s/\+/ /g"