topic Re: Replace '&' with ',' in Splunk Search

Replace '&' with ','

Jananee_iNautix — Mon, 28 Sep 2020 18:51:34 GMT

I want to replace the character '&' with the character ',' in the below field.

field = {call DB2GIPS.GIP_IP_SMRY_BROWSE(?& ?& ?& ?& ?& ?)},4,145.20738080143929,65.47478818893433,360.34633181989193,580.8295232057571,,2.2596316800361542E-4,,0.0

so that the result should be

field = {call DB2GIPS.GIP_IP_SMRY_BROWSE(?, ?, ?, ?, ?, ?)},4,145.20738080143929,65.47478818893433,360.34633181989193,580.8295232057571,,2.2596316800361542E-4,,0.0

How can that be done in splunk?Please advice.

Re: Replace '&' with ','

David — Thu, 05 Feb 2015 15:39:11 GMT

Easily:

rex mode=sed "s/&/,/g"

Does that work for you?

Re: Replace '&' with ','

ramdaspr — Fri, 06 Feb 2015 00:02:35 GMT

you also should specify the field name you want to rex or it might mangle up the rest of the raw data as well..
so rex field=myfieldname mode=sed "s/&/,/g"

Re: Replace '&' with ','

chimell — Mon, 09 Feb 2015 11:08:56 GMT

Hi 
Try this request :
      enter something here |field = {call DB2GIPS.GIP_IP_SMRY_BROWSE(?& ?& ?& ?& ?& ?)},4,145.20738080143929,65.47478818893433,360.34633181989193,580.8295232057571,,2.2596316800361542E-4,,0.0 | replace "(?& ?& ?& ?& ?& ?) "  with "(?, ?, ?, ?, ?, ?)" in field