Splunk Search

Replace from right side

Explorer

How to replace from right. for example I want to replace string "3:12:34" to "3 hours 12 minutes 34 seconds". but in case my input string is "12:34" only, it needs to be "12 minutes 34 seconds". It can only be achieved if I can replace ":" from right side first.

0 Karma

SplunkTrust
SplunkTrust

Here's how you could start:

... | eval step1 = replace(input, ":(\d\d)$", " \1 seconds")

The $ locks the matched part to the end of the string, essentially matching from the right side.

0 Karma