Splunk Search

Can I make a calculated field by regex replace on an existing field?

Contributor

Can I make this happen automatically? I know I can do it with the rex search command.

eval newField=sed(oldField, "s/aa/bb/g")

Esteemed Legend

You can do this in search:

... |eval newField = oldField | rex field=oldField mode=sed "s/aa/bb/"
0 Karma

Contributor

The regex replace has to work AUTOMATICALLY w/o adding anything to the query.

0 Karma

Esteemed Legend

Did you try it?

0 Karma

Contributor

oh i have just found it
replace(X,Y,Z)
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/CommonEvalFunctions

my next question is can i perform the replace w/o the /g?

0 Karma