Splunk Search

How to use replace in search?

kiran331
Builder

Hi

How to replace a character in a field value with another character? I have below field value, I have to replace @ with %40.

event_id:
32323ff-343443fg-43344g-34344-343434fdef@@notable@@33434fdf-3434gfgfg-ere343

I'm trying to get this

32323ff-343443fg-43344g-34344-343434fdef%40%40notable5%40%4033434fdf-3434gfgfg-ere343

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the replace function like this:

... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

Dawson014
Path Finder

Unrelated to this query, but for special characters like period (.) use the escape character -"\".
Like - ... | eval name = replace("lastname.firstname","\.",",") | ...

richgalloway
SplunkTrust
SplunkTrust

Use the replace function like this:

... | eval event_ID=replace(event_id,"@","%40") | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...