index=test TransactionId="xxx-xxx-xxx"| replace "000" with "" in Status| fields Status
I want to replace the first occurrence of "000" in status to blank.This is the command I wrote after referring to Splunk Documentation. However, the results don't show me the modified value of Status. Is there something missing in the command?
My end result should be the value of Status with "000" replaced.
Thanks for your help
try this
index=test | eval TransactionId="xxx-xxx-xxx" | replace *000* with ** in Status
try this
index=test | eval TransactionId="xxx-xxx-xxx" | replace *000* with ** in Status
Try like this
index=test TransactionId="xxx-xxx-xxx"| eval Status=replace(Status,"^000(.+)","\1") | fields Status
try a regex command:
|rex field=Status mode=sed "s/000//g"