topic Re: Replace 2 different characters in the same field in Splunk Search

How to replace 2 different characters in the same field?

fariapm1 — Thu, 26 Jan 2023 19:21:24 GMT

Hi,

I have a csv that is imported to splunk and one of those fields has a space for the thousands and ends with ",00", I need it to be an integer only with numbers.

I can solve this this with 2 lines:

| eval test=replace(field1,",00","")
| eval test=replace(test," ","")

But I want to create a new field with Calculated fields. How can I do that in one line of code?

Re: Replace 2 different characters in the same field

ITWhisperer — Thu, 26 Jan 2023 14:09:04 GMT

| eval test=replace(replace(field1,",00","")," ","")

Re: Replace 2 different characters in the same field

fariapm1 — Thu, 26 Jan 2023 14:18:25 GMT

Hi,

It worked.

I've already tried that but if you notice the space has a red dot. When I tried its only the " "

Tks for your help!

Re: Replace 2 different characters in the same field

ITWhisperer — Thu, 26 Jan 2023 14:23:16 GMT

Given that the replace function supports regex expressions, you could try it this way:

| eval test=replace(replace(field1,",00",""),"\s","")

Re: Replace 2 different characters in the same field

fariapm1 — Thu, 26 Jan 2023 15:06:10 GMT

In your opinion what's the most efficient ?

" " or "\s" ?

Re: Replace 2 different characters in the same field

ITWhisperer — Thu, 26 Jan 2023 15:23:09 GMT

It depends on your events - if spaces are the only type of white space used, then " " would be slightly more efficient, although improvement that might not be detectable, so if there is a possibility that other white space characters might be used, then "\s" might be safer.

Re: Replace 2 different characters in the same field

fariapm1 — Thu, 26 Jan 2023 15:31:50 GMT

Hi,

In this case it was a new type of space that appeared in my CSV file and it's not the 1st time that this happens.

Thank you for your support !!!