topic Re: Replace First Two Digits in Splunk Search

Replace First Two Digits

IRHM73 — Thu, 31 Aug 2017 11:25:56 GMT

Hi,

I wonder whether someone may be able to help me please.

I have a telephone number field "telnofac" with the first two digits being 44.

Could someone tell me please is there a way to replace these the 44 with a 0?

Many thanks and kind regards

Chris

Re: Replace First Two Digits

gcusello — Thu, 31 Aug 2017 11:39:18 GMT

Hi IRHM73,
two additional information:

do you want to replace numbers at index time or at search time?
do you want replace 44 with 0 or with 044?

if at index time and you want to replace 44 with 0, you have to insert in your props.conf in your sourcetype stanza (if before number there's "telnofac=")

SEDCMD-telnofac = s/telnofac\=44\d*/telnofac\=0\d*/g

(check regex!)

if you want to do this at search time and replace 44 with 0 use this command

| rex field=telnofac mode=sed "s/44\d*/0\d*/g"

| eval telnofac = replace(telnofac , "44\d*","0\d*")

Bye.
Giuseppe

Re: Replace First Two Digits

IRHM73 — Thu, 31 Aug 2017 11:57:42 GMT

Hi @cusello, thank you for the comprehensive reply.

I want to make the change at search time, so I used the second solution you provided but unfortunately, it didn't work with the output of the field now showing:

0\d*

Many thanks and kind regards

Chris

Re: Replace First Two Digits

gcusello — Tue, 29 Sep 2020 15:34:24 GMT

try with
| replace "44*" WITH "0*" IN telnofac
instead rex command
Bye.
Giuseppe

Re: Replace First Two Digits

IRHM73 — Thu, 31 Aug 2017 12:15:11 GMT

Thank you @cusello

Regards

Re: Replace First Two Digits

IRHM73 — Thu, 31 Aug 2017 12:22:58 GMT

Hi @cusello and all.

I was able to make a working solution using: sed "s/44/0/g"

Many thanks and kind regards

Chris

Re: Replace First Two Digits

s2_splunk — Thu, 31 Aug 2017 17:35:32 GMT

Chris, you are aware that this will change all occurrences of 44 with 0, so if your telnofac is 4412345446789, it will result in 01234506789; probably not what you want.

I would change it to | rex field=telnofac mode=sed "s/^44/0/" to only replace the first occurrence, anchored to the beginning of the field, just to be safe.

Re: Replace First Two Digits

IRHM73 — Fri, 01 Sep 2017 05:44:47 GMT

Hi @ssievert, that's great I hadn't realise that.

Thank you for taking the time to reply.

May I ask what the ^ does.

Many thanks and kind regards

Chris

Re: Replace First Two Digits

s2_splunk — Fri, 01 Sep 2017 21:21:07 GMT

"^" anchors to the beginning of the string. See here.

Re: Replace First Two Digits

IRHM73 — Mon, 04 Sep 2017 05:37:20 GMT

Many thanks @ssievert.

Regards

Chris