Splunk Search

How to replace a character with blank/space value?

zacksoft
Contributor

My field name is 'fileName' and the values it contains are like this:

PVOLFEPCL-00515+Berger+Profile+Settings.docx
Intake3++B2N+Lan+07492018.xlsm

I want it to be like this,

PVOLFEPCL-00515 Berger Profile Settings.docx
Intake3 B2N Lan 07492018.xlsm

The ''+" has to be replaced by Space .

I tried the following , but it doesn't work:

host="*evilcorp*.fantasy.com" "affirative"
| rex field=_raw "^[^&\n]*&\w+=(?P<fileName>[^ ]+)(?:[^ \n]* ){3}(?P<ttr>.+)" 
| table userid fileName ttr 
 | replace "+" WITH "" IN fileName
Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @zacksoft,

Please try below query.

<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"

Here is run anywhere search which is generating correct ouput

| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @zacksoft,

Please try below query.

<yourBaseQuery>
| rex mode=sed field=<fieldname> "s/([^\+])(?:\++)/\1 /g"

Here is run anywhere search which is generating correct ouput

| makeresults | eval testfield="PVOLFEPCL-00515+Berger+Profile+Settings.docx"
| append [ makeresults | eval testfield="Intake3++B2N+Lan+07492018.xlsm" ]
| rex mode=sed field=testfield "s/([^\+])(?:\++)/\1 /g"
0 Karma

harishalipaka
Motivator

hi @zacksoft

try this |makeresults |eval hari="Intake3++B2N+Lan+07492018.xlsm" |table hari | rex field=hari mode=sed "s/\+/ /g"

if it is helped accept as answer

Thanks
Harish
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...