How to replace the special characters with Space in text field in Dashboard

[shraysharma88]

I am looking for replacing "James:bond;sharma" with "James bond sharma"in text box in dashboard.

index=*  sourcetype=*  $Pattern$

The pattern is the token value for the Text box in Splunk Dashboard.
I want to replace all the special characters with space in token value while searching, as I don't want to search for special characters even if it is provided in text box in Splunk dashboard.

[wmyersas]

Here's one way you can do it:

| eval data=replace(data,"\W"," ")
| eval data=replace(data,"\ {2,}"," ")

That will remove any non-word characters, swapping for a space. Then replace any sequential spaces with a single space.

[shraysharma88]

index=TEST1 sourcetype=TEST2 |eval Patterns="VNRDUS33_:" | eval Pattern1 = upper(replace(Patterns,"([-:._])"," "))| return Pattern1 | search Pattern1

I am facing issue while trying to search the pattern now.
Replace is working as expected.

[wmyersas]

What are you using return for here?

[mayurr98]

Try rex to change replace special characters with space

| makeresults | eval data="James:bond;sharma"  | rex field=data mode=sed "s/(\w+)(:)(\w+)(;)(\w+)/\1 \3 \5/"

[shraysharma88]

James:bond;sharma is the input I have given in text box in dashboard.
And data in text box can be any thing like ram$shyam%hari.
I want to replace every special character with space.

Below is the search query for panel -:

index=* sourcetype=* $Pattern$

where Pattern is the token value used for text box in panel of dashboard

[mayurr98]

try this then

| rex field=data mode=sed "s/(\w+)([^\w]+)(\w+)([^\w]+)(\w+)/\1 \3 \5/"
this will replace any special character with space