Splunk Search

How to replace a character with blank/space value?

zacksoft
Contributor

My field name is 'fileName' and the values it contains are like this:

PVOLFEPCL-00515+Berger+Profile+Settings.docx
Intake3++B2N+Lan+07492018.xlsm

I want it to be like this,

PVOLFEPCL-00515 Berger Profile Settings.docx
Intake3 B2N Lan 07492018.xlsm

The ''+" has to be replaced by Space .

I tried the following , but it doesn't work:

host="*evilcorp*.fantasy.com" "affirative"
| rex field=_raw "^[^&\n]*&\w+=(?P<fileName>[^ ]+)(?:[^ \n]* ){3}(?P<ttr>.+)" 
| table userid fileName ttr 
 | replace "+" WITH "" IN fileName
Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @zacksoft,

Please try below query.

<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"

Here is run anywhere search which is generating correct ouput

| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @zacksoft,

Please try below query.

<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"

Here is run anywhere search which is generating correct ouput

| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"
0 Karma

harishalipaka
Motivator

hi @zacksoft

try this |makeresults |eval hari="Intake3++B2N+Lan+07492018.xlsm" |table hari | rex field=hari mode=sed "s/\+/ /g"

if it is helped accept as answer

Thanks
Harish
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...