Splunk Search

How to change a specific value of a field in my events to another value in a search?

fdi01
Motivator

i have these events:

status         |    host     |         comments          |   ticket_number  ...
inprogress         fdi_pc        tiket edited(17-04-15)           08
closed             hp_pc         tiket edited(17-04-15)           123
inprogress         hp_pc         tiket edited(16-04-15)           096
open               tiwa_pc       tiket edited(15-04-15)           123
closed             hp_pc         tiket edited(14-04-15)           123
open               fdi_pc        tiket edited(18-04-15)           124
open               tiwa_pc       tiket edited(15-04-15)           123

For example:
I want to change status="open" to status="new" (note that all can be repeated).
How can do it?

thanks

1 Solution

stephane_cyrill
Builder

Hi fdi01,

To do what you need you can use the rex command with mode=sed option like this:

... | rex field=fieldName mode=sed "s/your_regex/your_replacement_string/g"

What you have to do is to filter the event as you like> doing this you will replace the match expression by the replacement string

View solution in original post

vcgamesii
Explorer

If anyone is wondering about the timing of the 3 commands above (rex, replace, eval), I tested on my own dataset and results are:

rex probably fastest, with rex and eval both taking about 1s in fast mode, but taking about 4s in verbose mode.
replace takes about 4s in both fast and verbose mode

stephane_cyrill
Builder

Hi fdi01,

To do what you need you can use the rex command with mode=sed option like this:

... | rex field=fieldName mode=sed "s/your_regex/your_replacement_string/g"

What you have to do is to filter the event as you like> doing this you will replace the match expression by the replacement string

Raghav2384
Motivator

+1 to the above answer.

You can also try something like

....|replace "open" with "new" in status?

Thanks,
Raghav

srinivas_gowda
Path Finder

Just another doubt on the same kind here, what if all values do not have "open" and we will have to search to remove only the value "open" while retain its other fields and values?

0 Karma

fdi01
Motivator

thank raghav
it change all value of status
but i am filtering. very thank of you information with replace command.

0 Karma

aweitzman
Motivator

This ought to get you what you want:

... | eval status=if(status="open","new",status)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...