I'm trying to write a simple query to replace all of the values in a field (let's call this field
my_field) with a single value (like
According to the splunk docs on
replace, this should be pretty simple but the following query I have right now isn't working:
index="my_index" | replace * WITH "Hello World" IN my_field
I've also tried an even simpler query to replace a specific value (let's call this value
"Hello World", but that's not working either:
index="my_index" | replace "Puppies" WITH "Hello World" IN my_field
I know I'm missing something obvious. Any ideas about what I can do?
EDIT: I've also tried
index="my_index" | eval my_field=replace(my_field, *, "Hello World") but that didn't seem to work either
Here is one way, using rex in sed mode
| makeresults | eval raw2=split("f1=123 f2=456,f1=234 f2=567",",") | mvexpand raw2 | eval _raw=raw2 | extract | fields - _raw raw2 | rex mode=sed field=f1 "s/.*/Hello World/g"
No matter what values f1 has, they get replaced by Hello World.
_time f1 f2 2019-08-08 13:25:28 Hello World 456 2019-08-08 13:25:28 Hello World 567
@jpolvino I've already tried something similar to what you provided:
index="my_index" | rex mode=sed field=my_field "s/.*/Hello World/g" but that didn't work for an unknown reason.
@jpolvino It looks like a can create a new field whose values are all "Hello World" but when I try to set
new_field, it doesn't work, which boggles my mind b/c I've done very similar things before. Here's what I tried:
index="my_index" | eval new_field=replace(my_field, ".*", "Hello World") | eval my_field=new_field
For an unknown reason,
my_field does not get updated with
new_field's values 😞