- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
kiran331
Builder
09-05-2017
09:59 AM
Hi
How to replace a character in a field value with another character? I have below field value, I have to replace @ with %40.
event_id:
32323ff-343443fg-43344g-34344-343434fdef@@notable@@33434fdf-3434gfgfg-ere343
I'm trying to get this
32323ff-343443fg-43344g-34344-343434fdef%40%40notable5%40%4033434fdf-3434gfgfg-ere343
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
09-05-2017
10:33 AM
Use the replace
function like this:
... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dawson014
Path Finder
05-30-2018
06:13 AM
Unrelated to this query, but for special characters like period (.) use the escape character -"\".
Like - ... | eval name = replace("lastname.firstname","\.",",") | ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
09-05-2017
10:33 AM
Use the replace
function like this:
... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
