Splunk Search

Can I use regex to remove a pipe character from a string?

MikeElliott
Communicator

Hi All,

I am having a problem with my search output. One of the results contains a pipe ( | ) - E.g. bad_domain|www.baddomain.com.

Once run, the search results are passed to a 3rd party tool that uses pipes as formatting options - This rogue pipe is being picked up as a formatting option. I would like to know how to remove, or replace, the pipe in my search results, for example:

bad_domain|www.baddomain.com to bad_domain_www.baddomain.com, or bad_domain-www.baddomain.com.

Can anyone assist?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

View solution in original post

0 Karma

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

0 Karma

MikeElliott
Communicator

Worked perfectly - Thank you so very much!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...