Splunk Search

Can I use regex to remove a pipe character from a string?

MikeElliott
Communicator

Hi All,

I am having a problem with my search output. One of the results contains a pipe ( | ) - E.g. bad_domain|www.baddomain.com.

Once run, the search results are passed to a 3rd party tool that uses pipes as formatting options - This rogue pipe is being picked up as a formatting option. I would like to know how to remove, or replace, the pipe in my search results, for example:

bad_domain|www.baddomain.com to bad_domain_www.baddomain.com, or bad_domain-www.baddomain.com.

Can anyone assist?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

View solution in original post

0 Karma

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

0 Karma

MikeElliott
Communicator

Worked perfectly - Thank you so very much!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...