https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165956#M47201 <P>I have not tried, but can i use a replace in the EVAL-foo for search time extraction @martin_mueller ? i need to replace the newline character in that field but no answers till now <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Sat, 02 Aug 2014 15:53:28 GMT linu1988 2014-08-02T15:53:28Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165951#M47196 <P>I have a field extraction as below which extracts a date into a field called my_date</P> <PRE> EXTRACT-my_date = (?i)StopDateTimeLocal\W\W(?P<MY_DATE>.*?)\s </MY_DATE></PRE> <P>The above extraction will give me values like '2014-07-31'</P> <P>How can I change the extraction to replace '-' with '/' so that my values look like 2014/07/31 ?</P> Thu, 31 Jul 2014 17:52:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165951#M47196 pradeepkumarg 2014-07-31T17:52:16Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165952#M47197 <P>Since this is a search time field extraction, you can use replace function in your search. The other way is replace it during data ingestion. Using the SEDCMD in props.conf file.</P> <P>I am not sure if it can be done along with EXTRACT-fieldname.</P> Thu, 31 Jul 2014 19:06:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165952#M47197 strive 2014-07-31T19:06:16Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165953#M47198 <P>Indeed, <CODE>EXTRACT-foo</CODE> doesn't do replacements. On top of <CODE>replace()</CODE> in search and <CODE>SEDCMD-foo</CODE> at index time you can also use <CODE>strptime()</CODE> and <CODE>strftime()</CODE> in search to parse your date and produce a different formatted string.</P> Fri, 01 Aug 2014 22:54:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165953#M47198 martin_mueller 2014-08-01T22:54:14Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165954#M47199 <P>Thank you. I just wanted to check if we can do it during search time extraction</P> Sat, 02 Aug 2014 04:33:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165954#M47199 pradeepkumarg 2014-08-02T04:33:11Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165955#M47200 <P>You can of course define a calculated field (<CODE>EVAL-foo</CODE> in props.conf) to avoid having to do the calculation in every search.</P> Sat, 02 Aug 2014 10:25:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165955#M47200 martin_mueller 2014-08-02T10:25:53Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165956#M47201 <P>I have not tried, but can i use a replace in the EVAL-foo for search time extraction @martin_mueller ? i need to replace the newline character in that field but no answers till now <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Sat, 02 Aug 2014 15:53:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165956#M47201 linu1988 2014-08-02T15:53:28Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165957#M47202 <P>Is this about <A href="http://answers.splunk.com/answers/146092/how-do-i-ignore-the-new-line-character-in-the-_raw-field">http://answers.splunk.com/answers/146092/how-do-i-ignore-the-new-line-character-in-the-_raw-field</A>?</P> Sat, 02 Aug 2014 16:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-characters-in-string-from-field-extraction/m-p/165957#M47202 martin_mueller 2014-08-02T16:06:20Z