Splunk Search

How to use replace in search?

kiran331
Builder

Hi

How to replace a character in a field value with another character? I have below field value, I have to replace @ with %40.

event_id:
32323ff-343443fg-43344g-34344-343434fdef@@notable@@33434fdf-3434gfgfg-ere343

I'm trying to get this

32323ff-343443fg-43344g-34344-343434fdef%40%40notable5%40%4033434fdf-3434gfgfg-ere343

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the replace function like this:

... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Dawson014
Path Finder

Unrelated to this query, but for special characters like period (.) use the escape character -"\".
Like - ... | eval name = replace("lastname.firstname","\.",",") | ...

richgalloway
SplunkTrust
SplunkTrust

Use the replace function like this:

... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...