https://community.splunk.com/t5/Splunk-Search/Replacing-Field-Value/m-p/606470#M210936 <P>Hello, I have some field values which I am unable to replace with the 'replace' command in the csv file. I have Power States of servers which are Powered On and Powered Off and there are some fields which have both powered on and powered off status like:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">PoweredOn</TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">PoweredOff</TD></TR><TR><TD width="50%" height="77px">server name</TD><TD width="50%" height="77px"><P>poweredOn</P><P>poweredOff</P></TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">poweredOn poweredOff suspended</TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">poweredOff PoweredOn poweredOff</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I was able to change the field value of "poweredOn poweredOff suspended" with<BR />|replace&nbsp; "*poweredOff poweredOn suspended*" with "*Suspended*"<BR />but when I change the command with<BR />|replace&nbsp; "*poweredOn poweredOff*" with "*PoweredOn*"<BR />it doenst reflect. Can anyone tell me how to replace these?</P> Thu, 21 Jul 2022 09:52:48 GMT beepbop 2022-07-21T09:52:48Z https://community.splunk.com/t5/Splunk-Search/Replacing-Field-Value/m-p/606470#M210936 <P>Hello, I have some field values which I am unable to replace with the 'replace' command in the csv file. I have Power States of servers which are Powered On and Powered Off and there are some fields which have both powered on and powered off status like:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">PoweredOn</TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">PoweredOff</TD></TR><TR><TD width="50%" height="77px">server name</TD><TD width="50%" height="77px"><P>poweredOn</P><P>poweredOff</P></TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">poweredOn poweredOff suspended</TD></TR><TR><TD width="50%" height="25px">server name</TD><TD width="50%" height="25px">poweredOff PoweredOn poweredOff</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>I was able to change the field value of "poweredOn poweredOff suspended" with<BR />|replace&nbsp; "*poweredOff poweredOn suspended*" with "*Suspended*"<BR />but when I change the command with<BR />|replace&nbsp; "*poweredOn poweredOff*" with "*PoweredOn*"<BR />it doenst reflect. Can anyone tell me how to replace these?</P> Thu, 21 Jul 2022 09:52:48 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-Field-Value/m-p/606470#M210936 beepbop 2022-07-21T09:52:48Z https://community.splunk.com/t5/Splunk-Search/Replacing-Field-Value/m-p/606476#M210940 <LI-CODE lang="markup">| rex mode=sed "s/poweredOn poweredOff suspended/Suspended/g"</LI-CODE> Thu, 21 Jul 2022 11:05:19 GMT https://community.splunk.com/t5/Splunk-Search/Replacing-Field-Value/m-p/606476#M210940 ITWhisperer 2022-07-21T11:05:19Z