Splunk Search

how to replace a multiple character to one character

abhayneilam
Contributor

Hi,

I want to replace all ":*" character means :: ::: :::: and so on with only singel ":" character.
for Location field.

Kindly help !!

Thanks in advance !!
Abhay

mannioke
Engager

Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this.

| eval _raw = replace (_raw," +","=")

This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough.

| eval _raw = replace (_raw,": :","::")
| eval _raw = replace (_raw,"::+",":")

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You will want to use the eval command.

your_search | eval new_location = replace(Location, ":+",":")|more_your_search

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

alacercogitatus
SplunkTrust
SplunkTrust

field names are case sensitive. what value does "op" have? It should be |eval op = one.":".two.":".three.":".four|

0 Karma

abhayneilam
Contributor

I am running this query, but there is no change :

index="maa" | rex field="Location" (?(?i)"delhi")| rex field="Location" (?"mumbai")|rex field="Location" (?"kol")| rex field="Location" (?"bu is") | fillnull value=" " | eval op=ONE.":".TWO.":".THREE.":".FOUR | eval o=replace(op,":+",":")|table Name Age Location o | sort o + desc

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You could try: eval Location=replace(Location,":*",":"), if that doesn't work, could you post some sanatized data to look at?

abhayneilam
Contributor

but it is not coming, my multiple : is not getting replaced

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...