Hi @WXY
You probably want to use the replace command.
Let's create a test field called foo and then a new field called changed to illustrated how to use replace.
index=<your search here>
| eval foo="a/b"
|eval changed=replace(foo,"/","_")
|table foo,changed
hi @wxy,
Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Hi @WXY
You probably want to use the replace command.
Let's create a test field called foo and then a new field called changed to illustrated how to use replace.
index=<your search here>
| eval foo="a/b"
|eval changed=replace(foo,"/","_")
|table foo,changed