Splunk Search

replace String issue

maxmukimov
Explorer

Hello!
I’m trying to replace product codes with product names like
| replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon”
I’m getting what I want except when there are more than one value in Product code field.
Apple
Grape
A1 | A2
How can I fix the row with multiple values?
Thank you.

Labels (1)
0 Karma
1 Solution

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

maxmukimov
Explorer

Thank you @efavreau !

I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why

|replace “A1” with “Apple”

wasn’t recognizing “A1 | A2”, what I did was, I added

| eval product=split(product, “ | “)

And now I’m getting the result I wanted.

Apple
Grape
Apple  Grape

Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question.

Thank you again!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...