Splunk Search

How do you remove part of a field value?

zikpefu
New Member

I am trying to remove the +'s in between words for my table (i.e. stainless+steel to be just stainless steel) and my field name is SearchTerm. I tried the eval replace command method but it keeps saying Regex quantifier does not follow repeatable item; I do not know what to do. Any help would be appreciated.

My eval command:

| eval SearchTerm=replace(SearchTerm,"+"," ")

Edit: Spelling

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to escape like this (because + is a special command character):

 | eval SearchTerm=replace(SearchTerm,"\+"," ")

I would do it like this:

| rex field=SearchTerm mode=sed "s/\+/ /g"

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need to escape like this (because + is a special command character):

 | eval SearchTerm=replace(SearchTerm,"\+"," ")

I would do it like this:

| rex field=SearchTerm mode=sed "s/\+/ /g"
0 Karma

renjith_nair
Legend

Hi @zikpefu

escape '+'

eval SearchTerm=replace(SearchTerm,"\+"," ")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...