https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263670#M79131 <P>hi,<BR /> how can i change the content of multivalued field using regex.</P> <P>i have a multivalued field and i try to modify the values, but nothing match with my regex.</P> <P>how can i do?</P> <P>thx</P> Mon, 18 Jul 2016 11:53:45 GMT sfatnass 2016-07-18T11:53:45Z https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263670#M79131 <P>hi,<BR /> how can i change the content of multivalued field using regex.</P> <P>i have a multivalued field and i try to modify the values, but nothing match with my regex.</P> <P>how can i do?</P> <P>thx</P> Mon, 18 Jul 2016 11:53:45 GMT https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263670#M79131 sfatnass 2016-07-18T11:53:45Z https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263671#M79132 <P>Hi, sfatnass,</P> <P>Can you provide </P> <UL> <LI>an example of the multivalued field </LI> <LI>the command you are trying to run against it </LI> <LI>a description of what you are trying to do</LI> </UL> <P>Thanks! </P> Mon, 18 Jul 2016 11:56:56 GMT https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263671#M79132 Richfez 2016-07-18T11:56:56Z https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263672#M79133 <P>I always use <CODE>rex</CODE>. It will run against all values. For example, try this to replace all <CODE>spaces</CODE> with <CODE>underscores</CODE> in all values of field <CODE>MyField</CODE>.</P> <PRE><CODE>... | rex field=MyField mode=sed "s/ /_/g" </CODE></PRE> Mon, 18 Jul 2016 14:07:03 GMT https://community.splunk.com/t5/Splunk-Search/how-can-i-modify-multivalued-field/m-p/263672#M79133 woodcock 2016-07-18T14:07:03Z