Splunk Search

Modify Fields in Splunk search app

misteryuku
Communicator

For the search app, I want to modify a field called "partner" (new field added when data is sent to Splunk in receivers endpoint) with a value of "Yan Yi" and replace the "partner" field value to
"muktar".

I put in this search command in the search app,
sourcetype = " sexuality" | replace Yan Yi with muktar in partner

The search app threw an error :
[EventsViewer module] Error in 'replace' command : Usage replace[orig_str WITH new_str] + [IN field1,field2,..]

What is the issue with this? Is there any way i could correact the syntax of the search command??

Tags (3)
0 Karma

Ayn
Legend

You need to enclose "Yan Yi" in quotes.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...