Splunk Search

Can I use regex to remove a pipe character from a string?

MikeElliott
Communicator

Hi All,

I am having a problem with my search output. One of the results contains a pipe ( | ) - E.g. bad_domain|www.baddomain.com.

Once run, the search results are passed to a 3rd party tool that uses pipes as formatting options - This rogue pipe is being picked up as a formatting option. I would like to know how to remove, or replace, the pipe in my search results, for example:

bad_domain|www.baddomain.com to bad_domain_www.baddomain.com, or bad_domain-www.baddomain.com.

Can anyone assist?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

View solution in original post

0 Karma

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

0 Karma

MikeElliott
Communicator

Worked perfectly - Thank you so very much!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...