Splunk Search

How do you remove part of a field value?

zikpefu
New Member

I am trying to remove the +'s in between words for my table (i.e. stainless+steel to be just stainless steel) and my field name is SearchTerm. I tried the eval replace command method but it keeps saying Regex quantifier does not follow repeatable item; I do not know what to do. Any help would be appreciated.

My eval command:

| eval SearchTerm=replace(SearchTerm,"+"," ")

Edit: Spelling

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You need to escape like this (because + is a special command character):

 | eval SearchTerm=replace(SearchTerm,"\+"," ")

I would do it like this:

| rex field=SearchTerm mode=sed "s/\+/ /g"

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need to escape like this (because + is a special command character):

 | eval SearchTerm=replace(SearchTerm,"\+"," ")

I would do it like this:

| rex field=SearchTerm mode=sed "s/\+/ /g"
0 Karma

renjith_nair
Legend

Hi @zikpefu

escape '+'

eval SearchTerm=replace(SearchTerm,"\+"," ")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...