how to replace a multiple character to one character

[abhayneilam]

Hi,

I want to replace all ":*" character means :: ::: :::: and so on with only singel ":" character.
for Location field.

Kindly help !!

Thanks in advance !!
Abhay

[mannioke]

Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this.

| eval _raw = replace (_raw," +","=")

This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough.

| eval _raw = replace (_raw,": :","::")
| eval _raw = replace (_raw,"::+",":")

[alacercogitatus]

You will want to use the eval command.

your_search | eval new_location = replace(Location, ":+",":")|more_your_search

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

[alacercogitatus]

field names are case sensitive. what value does "op" have? It should be |eval op = one.":".two.":".three.":".four|

[abhayneilam]

I am running this query, but there is no change :

index="maa" | rex field="Location" (?(?i)"delhi")| rex field="Location" (?"mumbai")|rex field="Location" (?"kol")| rex field="Location" (?"bu is") | fillnull value=" " | eval op=ONE.":".TWO.":".THREE.":".FOUR | eval o=replace(op,":+",":")|table Name Age Location o | sort o + desc

[alacercogitatus]

You could try: eval Location=replace(Location,":*",":"), if that doesn't work, could you post some sanatized data to look at?

[abhayneilam]

but it is not coming, my multiple : is not getting replaced