topic Re: Eval replace function not working in Splunk Search

Eval replace function not working

k_harini — Tue, 18 Oct 2016 07:19:00 GMT

I was trying to create calculated fields as field values are huge. For 1 field I could do that. For other field where values are lengthy i could not do with eval replace
EVAL-Category = replace('Category',"Change Request","CR")
EVAL-Category = replace('Category',"Central Functions","CF")
EVAL-Category = replace('Category',"Materials Management (MM)","MM")

Also tried with query - index="myindex"| stats values(Category) |eval Category = replace(Category,"Change Request","CR") is not working
Values are like Change Request-Structural Method-blah blah.. I want to replace with short form for values.. How to get that? Please suggest

Re: Eval replace function not working

inventsekar — Tue, 18 Oct 2016 13:07:42 GMT

index="myindex"| stats values(Category) |eval Category = replace(Category,"Change Request","CR")
replace should not be used like this with eval, i think. i remember this one should be "Case"
please try -

index="myindex"| stats values(Category) |eval Category = case(Category,"Change Request","CR")

Re: Eval replace function not working

lakromani — Tue, 18 Oct 2016 13:08:34 GMT

Try this:

 query - index="myindex"| stats values(Category) | replace "Change Request" WITH "CR" IN Category

All in one go:

query - index="myindex" 
| stats values(Category) 
| replace "Change Request" WITH "CR" 
  , "Central Functions" WITH "CF"
  , "Materials Management (MM)" WITH "MM" IN Category

Re: Eval replace function not working

JDukeSplunk — Tue, 18 Oct 2016 13:11:39 GMT

I used "Eval Case" to replace the values similar to this. We ended up using a lookup table, since there were 70 possible values and the query was thus very long.

Here's a snippet of my code that you could adapt. In my case, I wanted to add the more verbose value. So PEGA0001 was replaced with the longer version after the comma. The 1=1, "Google It.." at the end is a catch all, for any value not defined in the case string.

|eval PegaAlertV=case(PegaAlert="PEGA0001","PEGA0001-HTTP interaction time exceeds limit", 
 PegaAlert="PEGA0002","PEGA0002-Commit operation time exceeds limit", 
 PegaAlert="PEGA0003","PEGA0003-Rollback operation time exceeds limit", 
 PegaAlert="PEGA0004","PEGA0004-Quantity of data received by database query exceeds limit", 
 PegaAlert="PEGA0056","PEGA0056-Defragmentation of the table associated with class System-Locks takes too long",
 1=1,"Google It..")

-JD

Re: Eval replace function not working

k_harini — Thu, 20 Oct 2016 04:33:38 GMT

Thanks for response everyone.. None of these are working.. My field values are like "Change Request - HR & Payroll - Time Management (TM)" and "Change Request - Logistics - Materials Management (MM)".. I have to replace part of the string in each field value.. Im able to get this done with rex and sed..
rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/"

But i want to add this as calculated field using eval.. Any ideas on this..? Thanks a lot..