Solved: Re: Can you rename strings within mv-fields - Splunk Community

Getting Data In

Id like to rename every instance of "dragDrop" to "stackDragDrop" from a multi-value field.

The search below just renames one instance. Any ideas on how to do this?

source="C:\\var\\regression_items\\*.xml" 
| rex "title=\"(?P<id>\d+)\"" 
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK = "dragDrop")
| eval selectionElements=case(TEST="dragDrop", "stackDragDrop") 
| table id selectionElements TEST

1 Solution

Solution

Try this

source="C:\\var\\regression_items\\*.xml" 
| rex "title=\"(?P<id>\d+)\"" 
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK="dragDrop") |eval selectionElements=TEST | replace dragDrop with stackDragDrop in selectionElements
| table id selectionElements TEST

View solution in original post

Solution

Try this

source="C:\\var\\regression_items\\*.xml" 
| rex "title=\"(?P<id>\d+)\"" 
| rex max_match=0 "(class=\"stack\").+(data-type=\")(?P<STACK>\w+)(\")"
| eval TEST=mvfilter(STACK="dragDrop") |eval selectionElements=TEST | replace dragDrop with stackDragDrop in selectionElements
| table id selectionElements TEST

Perfect! I was missing replace. Thanks!

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...