Splunk Search

How to replace 2 different characters in the same field?

fariapm1
Explorer

Hi,

I have a csv that is imported to splunk and one of those fields has a space for the thousands and ends with  ",00",  I need it to be an integer only with numbers.

fariapm1_1-1674740198350.png

 

I can solve this this with 2 lines:

       | eval test=replace(field1,",00","")
       | eval test=replace(test," ","")

But I want to create a new field with Calculated fields. How can I do that in one line of code?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval test=replace(replace(field1,",00","")," ","")

View solution in original post

fariapm1
Explorer

Hi,

It worked. 

I've already tried that but if you notice the space has a red dot. When I tried its only the " "

fariapm1_0-1674742668161.png

 

Tks for your help!

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that the replace function supports regex expressions, you could try it this way:

| eval test=replace(replace(field1,",00",""),"\s","")
0 Karma

fariapm1
Explorer

In your opinion what's the most efficient ?

" " or "\s" ?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on your events - if spaces are the only type of white space used, then " " would be slightly more efficient, although improvement that might not be detectable, so if there is a possibility that other white space characters might be used, then "\s" might be safer.

0 Karma

fariapm1
Explorer

Hi,

In this case it was a new type of space that appeared in my CSV file and it's not the 1st time that this happens.

Thank you for your support !!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval test=replace(replace(field1,",00","")," ","")
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...