Splunk Search
Highlighted

Why isn't my replace command working in this search?

Path Finder
index=test TransactionId="xxx-xxx-xxx"|  replace "000" with "" in Status| fields Status

I want to replace the first occurrence of "000" in status to blank.This is the command I wrote after referring to Splunk Documentation. However, the results don't show me the modified value of Status. Is there something missing in the command?

My end result should be the value of Status with "000" replaced.

Thanks for your help

0 Karma
Highlighted

Re: Why isn't my replace command working in this search?

Super Champion

try a regex command:

|rex field=Status mode=sed "s/000//g"
0 Karma
Highlighted

Re: Why isn't my replace command working in this search?

SplunkTrust
SplunkTrust

Try like this

 index=test TransactionId="xxx-xxx-xxx"| eval Status=replace(Status,"^000(.+)","\1") | fields Status
0 Karma
Highlighted

Re: Why isn't my replace command working in this search?

Motivator

try this

index=test | eval TransactionId="xxx-xxx-xxx" | replace *000* with ** in Status

View solution in original post