Splunk Search

how to replace a multiple character to one character

abhayneilam
Contributor

Hi,

I want to replace all ":*" character means :: ::: :::: and so on with only singel ":" character.
for Location field.

Kindly help !!

Thanks in advance !!
Abhay

mannioke
Engager

Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this.

| eval _raw = replace (_raw," +","=")

This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough.

| eval _raw = replace (_raw,": :","::")
| eval _raw = replace (_raw,"::+",":")

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You will want to use the eval command.

your_search | eval new_location = replace(Location, ":+",":")|more_your_search

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

alacercogitatus
SplunkTrust
SplunkTrust

field names are case sensitive. what value does "op" have? It should be |eval op = one.":".two.":".three.":".four|

0 Karma

abhayneilam
Contributor

I am running this query, but there is no change :

index="maa" | rex field="Location" (?(?i)"delhi")| rex field="Location" (?"mumbai")|rex field="Location" (?"kol")| rex field="Location" (?"bu is") | fillnull value=" " | eval op=ONE.":".TWO.":".THREE.":".FOUR | eval o=replace(op,":+",":")|table Name Age Location o | sort o + desc

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You could try: eval Location=replace(Location,":*",":"), if that doesn't work, could you post some sanatized data to look at?

abhayneilam
Contributor

but it is not coming, my multiple : is not getting replaced

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...