Splunk Search

Can you help me replace one slash with "_" so I can extract a field?

WXY
Path Finder

Hi.

I want to get a field.

Now this field named location_code contains "/" such as "/home/name/p"

I want to replace the "/" with "_" so I can match another field value,

What should I do ?

Tags (2)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi @WXY

You probably want to use the replace command.

Let's create a test field called foo and then a new field called changed to illustrated how to use replace.

index=<your search here> 
| eval foo="a/b"
|eval changed=replace(foo,"/","_")
|table foo,changed

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @wxy,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi @WXY

You probably want to use the replace command.

Let's create a test field called foo and then a new field called changed to illustrated how to use replace.

index=<your search here> 
| eval foo="a/b"
|eval changed=replace(foo,"/","_")
|table foo,changed
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...