Splunk Search
Highlighted

Replace command -Ignore case

Explorer

How can we use case insensitive value in Replace command-
| replace "name" with "entity" in description

will it replace name , NAME, Name, NaMe etc with entity ????

If not how can we ignore case with replace command.

0 Karma
Highlighted

Re: Replace command -Ignore case

SplunkTrust
SplunkTrust

@shugup2923

Try

| eval description=replace(description,"(?i)name","entity")

View solution in original post

0 Karma