Splunk Search

How to replace characters in string from field extraction?

pradeepkumarg
Influencer

I have a field extraction as below which extracts a date into a field called my_date

EXTRACT-my_date = (?i)StopDateTimeLocal\W\W(?P.*?)\s 

The above extraction will give me values like '2014-07-31'

How can I change the extraction to replace '-' with '/' so that my values look like 2014/07/31 ?

0 Karma
1 Solution

strive
Influencer

Since this is a search time field extraction, you can use replace function in your search. The other way is replace it during data ingestion. Using the SEDCMD in props.conf file.

I am not sure if it can be done along with EXTRACT-fieldname.

View solution in original post

strive
Influencer

Since this is a search time field extraction, you can use replace function in your search. The other way is replace it during data ingestion. Using the SEDCMD in props.conf file.

I am not sure if it can be done along with EXTRACT-fieldname.

linu1988
Champion

I have not tried, but can i use a replace in the EVAL-foo for search time extraction @martin_mueller ? i need to replace the newline character in that field but no answers till now 😞

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can of course define a calculated field (EVAL-foo in props.conf) to avoid having to do the calculation in every search.

0 Karma

pradeepkumarg
Influencer

Thank you. I just wanted to check if we can do it during search time extraction

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Indeed, EXTRACT-foo doesn't do replacements. On top of replace() in search and SEDCMD-foo at index time you can also use strptime() and strftime() in search to parse your date and produce a different formatted string.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...