Splunk Search

Can I make a calculated field by regex replace on an existing field?

hylam
Contributor

Can I make this happen automatically? I know I can do it with the rex search command.

eval newField=sed(oldField, "s/aa/bb/g")

woodcock
Esteemed Legend

You can do this in search:

... |eval newField = oldField | rex field=oldField mode=sed "s/aa/bb/"
0 Karma

hylam
Contributor

The regex replace has to work AUTOMATICALLY w/o adding anything to the query.

0 Karma

woodcock
Esteemed Legend

Did you try it?

0 Karma

hylam
Contributor

oh i have just found it
replace(X,Y,Z)
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

my next question is can i perform the replace w/o the /g?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...