topic Re: How to remove or replace "-" from a field)? in Splunk Search

How to remove or replace "-" from a field)?

hellothere — Wed, 18 May 2022 16:51:53 GMT

Hello all,

I have a field that contains hypens in the value. For example, 20.0--(1259).

I am simply trying to replace it with space, but it does not work. could you tell me what am I doing wrong?

index=main
| eval version_name = replace(version, "-", " ")

richgalloway — Wed, 18 May 2022 17:27:49 GMT

Please explain what you mean by "it does not work". Your code works fine in my Splunk sandbox. "20.0--(1259)" becomes "20.0 (1259)".

ITWhisperer — Wed, 18 May 2022 17:30:57 GMT

Your code looks OK - unless your real field name has special characters in - in which case, put it in single quotes.