https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205903#M59884 <P>Try</P> <PRE><CODE>eval my-new-field=replace(string-to-replace,"\*","") </CODE></PRE> Wed, 17 Feb 2016 10:03:58 GMT renjith_nair 2016-02-17T10:03:58Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205902#M59883 <P>I want to replace the <CODE>*</CODE> character in a string with the replace command. How do I apply the <CODE>*</CODE> by escaping it, not to replace the whole string? </P> Wed, 17 Feb 2016 09:58:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205902#M59883 szabados 2016-02-17T09:58:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205903#M59884 <P>Try</P> <PRE><CODE>eval my-new-field=replace(string-to-replace,"\*","") </CODE></PRE> Wed, 17 Feb 2016 10:03:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205903#M59884 renjith_nair 2016-02-17T10:03:58Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205904#M59885 <P>Hi<BR /> You can use rex command with mode=sed attribute . see the following</P> <PRE><CODE> ..........................| rex mode=sed "s/\"\"/\"\*\"/g" </CODE></PRE> Wed, 17 Feb 2016 10:24:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-replace-an-asterisk-character-in-a/m-p/205904#M59885 chimell 2016-02-17T10:24:27Z