Splunk Search

Replacing Field Value

beepbop
Explorer

Hello, I have some field values which I am unable to replace with the 'replace' command in the csv file. I have Power States of servers which are Powered On and Powered Off and there are some fields which have both powered on and powered off status like:

server namePoweredOn
server namePoweredOff
server name

poweredOn

poweredOff

server namepoweredOn poweredOff suspended
server namepoweredOff PoweredOn poweredOff

 

I was able to change the field value of "poweredOn poweredOff suspended" with
|replace  "*poweredOff poweredOn suspended*" with "*Suspended*"
but when I change the command with
|replace  "*poweredOn poweredOff*" with "*PoweredOn*"
it doenst reflect. Can anyone tell me how to replace these?

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/poweredOn poweredOff suspended/Suspended/g"
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...