Splunk Search
Highlighted

How to replace column values in a CSV with static text?

Hi,
I have a CSV file as shown below:

PARAMETER   VALUE
param1       val1
param4     val2
param2     val3
param1     val4
param7     val5
param2       val6

I want to replace all the values inside column named "PARAMETER" with text "common", so whatever values comes inside column "PARAMETER", it should be changed with text "common", Like below:

PARAMETER   VALUE
common     val1
common     val2
common     val3
common     val4
common     val5
common     val6

Please Help...!!!

Tags (4)
Highlighted

Re: How to replace column values in a CSV with static text?

SplunkTrust
SplunkTrust

Options

1) Indextime - REX CMD - props.conf on Indexer/Heavy Forwarder

 [yoursourcetype]
...current configurations...
SEDCMD-staticparam = s/([^,]+),(.*)/common,\2/g

2) Search Time - Calculated fields

[yoursourcetype]
...current configurations...
EVAL-PARAMETER = "common"

View solution in original post