https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234572#M69702 <P>The regex replace has to work <EM>AUTOMATICALLY</EM> w/o adding anything to the query. </P> Fri, 13 Nov 2015 23:29:35 GMT hylam 2015-11-13T23:29:35Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234568#M69698 <P>Can I make this happen automatically? I know I can do it with the rex search command.</P> <PRE><CODE>eval newField=sed(oldField, "s/aa/bb/g") </CODE></PRE> Fri, 13 Nov 2015 13:01:20 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234568#M69698 hylam 2015-11-13T13:01:20Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234569#M69699 <P>Did you try it?</P> Fri, 13 Nov 2015 15:52:17 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234569#M69699 woodcock 2015-11-13T15:52:17Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234570#M69700 <P>oh i have just found it<BR /> replace(X,Y,Z)<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions</A></P> <P>my next question is can i perform the replace w/o the /g?</P> Fri, 13 Nov 2015 16:13:30 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234570#M69700 hylam 2015-11-13T16:13:30Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234571#M69701 <P>You can do this in search:</P> <PRE><CODE>... |eval newField = oldField | rex field=oldField mode=sed "s/aa/bb/" </CODE></PRE> Fri, 13 Nov 2015 19:11:17 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234571#M69701 woodcock 2015-11-13T19:11:17Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234572#M69702 <P>The regex replace has to work <EM>AUTOMATICALLY</EM> w/o adding anything to the query. </P> Fri, 13 Nov 2015 23:29:35 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-calculated-field-by-regex-replace-on-an-existing/m-p/234572#M69702 hylam 2015-11-13T23:29:35Z