Can I make this happen automatically? I know I can do it with the rex search command.
eval newField=sed(oldField, "s/aa/bb/g")
You can do this in search:
... |eval newField = oldField | rex field=oldField mode=sed "s/aa/bb/"
The regex replace has to work AUTOMATICALLY w/o adding anything to the query.
Did you try it?
oh i have just found it replace(X,Y,Z) http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions
my next question is can i perform the replace w/o the /g?
