Splunk Search

Can I make a calculated field by regex replace on an existing field?

hylam
Contributor

Can I make this happen automatically? I know I can do it with the rex search command.

eval newField=sed(oldField, "s/aa/bb/g")

woodcock
Esteemed Legend

You can do this in search:

... |eval newField = oldField | rex field=oldField mode=sed "s/aa/bb/"
0 Karma

hylam
Contributor

The regex replace has to work AUTOMATICALLY w/o adding anything to the query.

0 Karma

woodcock
Esteemed Legend

Did you try it?

0 Karma

hylam
Contributor

oh i have just found it
replace(X,Y,Z)
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

my next question is can i perform the replace w/o the /g?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...