https://community.splunk.com/t5/Splunk-Search/Modify-Fields-in-Splunk-search-app/m-p/102737#M26552 <P>For the search app, I want to modify a field called "partner" (new field added when data is sent to Splunk in receivers endpoint) with a value of "Yan Yi" and replace the "partner" field value to <BR /> "muktar".</P> <P>I put in this search command in the search app,<BR /> sourcetype = " sexuality" | replace Yan Yi with muktar in partner </P> <P>The search app threw an error : <BR /> [EventsViewer module] Error in 'replace' command : Usage replace[orig_str WITH new_str] + [IN field1,field2,..]</P> <P>What is the issue with this? Is there any way i could correact the syntax of the search command??</P> Mon, 28 Sep 2020 11:35:00 GMT misteryuku 2020-09-28T11:35:00Z https://community.splunk.com/t5/Splunk-Search/Modify-Fields-in-Splunk-search-app/m-p/102737#M26552 <P>For the search app, I want to modify a field called "partner" (new field added when data is sent to Splunk in receivers endpoint) with a value of "Yan Yi" and replace the "partner" field value to <BR /> "muktar".</P> <P>I put in this search command in the search app,<BR /> sourcetype = " sexuality" | replace Yan Yi with muktar in partner </P> <P>The search app threw an error : <BR /> [EventsViewer module] Error in 'replace' command : Usage replace[orig_str WITH new_str] + [IN field1,field2,..]</P> <P>What is the issue with this? Is there any way i could correact the syntax of the search command??</P> Mon, 28 Sep 2020 11:35:00 GMT https://community.splunk.com/t5/Splunk-Search/Modify-Fields-in-Splunk-search-app/m-p/102737#M26552 misteryuku 2020-09-28T11:35:00Z https://community.splunk.com/t5/Splunk-Search/Modify-Fields-in-Splunk-search-app/m-p/102738#M26553 <P>You need to enclose "Yan Yi" in quotes.</P> Wed, 28 Mar 2012 04:50:07 GMT https://community.splunk.com/t5/Splunk-Search/Modify-Fields-in-Splunk-search-app/m-p/102738#M26553 Ayn 2012-03-28T04:50:07Z