Splunk Search

Can I use regex to remove a pipe character from a string?

MikeElliott
Communicator

Hi All,

I am having a problem with my search output. One of the results contains a pipe ( | ) - E.g. bad_domain|www.baddomain.com.

Once run, the search results are passed to a 3rd party tool that uses pipes as formatting options - This rogue pipe is being picked up as a formatting option. I would like to know how to remove, or replace, the pipe in my search results, for example:

bad_domain|www.baddomain.com to bad_domain_www.baddomain.com, or bad_domain-www.baddomain.com.

Can anyone assist?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

View solution in original post

0 Karma

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

0 Karma

MikeElliott
Communicator

Worked perfectly - Thank you so very much!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...