topic Re: replace special character "*" with NULL in datamodel in Splunk Search

replace special character "*" with NULL in datamodel

goyals05 — Wed, 24 Jan 2018 11:23:18 GMT

Hi,

In one of my numeric field sometimes I am getting value as " * ". I want to replace it with either NA or NULL if its " * ".

I am looking to add this regex in data model.

mayurr98 — Wed, 24 Jan 2018 12:18:07 GMT

hey @goyals05

you can try this run anywhere search

| makeresults 
| eval raw="* 20 30 04 3 2 5 *" 
| makemv raw 
| mvexpand raw 
| rex field=raw mode=sed "s/\*/NA/g"

| makeresults 
| eval raw="* 20 30 04 3 2 5 *" 
| makemv raw 
| mvexpand raw 
| eval raw1=case(raw="*","NA",1=1,raw)

Also in your environment, you should write in eval expression of data model

case(raw="*","NA",1=1,raw)

you can try anyone of these. which one you like bro? 🙂
let me know if this helps!

goyals05 — Wed, 24 Jan 2018 13:00:57 GMT

Not sure if 1st one can be used in data model. But 2nd option worked for me. Cheers!!