topic Re: Splunk bug: string replace function fails if the string to be replaced starts with "+" character in Splunk Search

Splunk bug: string replace function fails if the string to be replaced starts with "+" character

Dev999 — Fri, 17 Feb 2023 16:28:53 GMT

replace() function produce an empty string if the string to be replaced starts with a "+" character.

this search with replace() works:

this one will produce an empty message2:

Re: Splunk bug: string replace function fails if the string to be replaced starts with "+" character

ITWhisperer — Fri, 17 Feb 2023 16:48:40 GMT

The replace function treats the string to be replaced as a regex - "+" is a special character in regex and because it isn't preceded by anything, this makes the regex invalid, hence, it does perform as expected.

Re: Splunk bug: string replace function fails if the string to be replaced starts with "+" character

Dev999 — Fri, 17 Feb 2023 17:02:23 GMT

the function should have ways to escape the special characters. As you can see above, the extraction rex has no problem handling it.

Re: Splunk bug: string replace function fails if the string to be replaced starts with "+" character

ITWhisperer — Fri, 17 Feb 2023 17:54:56 GMT

The extraction works because the extracted string is not processed as a regex (until you put it in the replace function).

You could try something like this

| rex mode=sed field=ph1 "s/([\+\\\*\{\}\[\]\.\(\)\|\?])/#\#\1/g" | rex mode=sed field=ph1 "s/#//g" | eval message2 = replace(message, ph1, ph2)