Splunk Search

replace String issue

maxmukimov
Explorer

Hello!
I’m trying to replace product codes with product names like
| replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon”
I’m getting what I want except when there are more than one value in Product code field.
Apple
Grape
A1 | A2
How can I fix the row with multiple values?
Thank you.

Labels (1)
0 Karma
1 Solution

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

maxmukimov
Explorer

Thank you @efavreau !

I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why

|replace “A1” with “Apple”

wasn’t recognizing “A1 | A2”, what I did was, I added

| eval product=split(product, “ | “)

And now I’m getting the result I wanted.

Apple
Grape
Apple  Grape

Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question.

Thank you again!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...