Splunk Search

replace String issue

maxmukimov
Explorer

Hello!
I’m trying to replace product codes with product names like
| replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon”
I’m getting what I want except when there are more than one value in Product code field.
Apple
Grape
A1 | A2
How can I fix the row with multiple values?
Thank you.

Labels (1)
0 Karma
1 Solution

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

maxmukimov
Explorer

Thank you @efavreau !

I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why

|replace “A1” with “Apple”

wasn’t recognizing “A1 | A2”, what I did was, I added

| eval product=split(product, “ | “)

And now I’m getting the result I wanted.

Apple
Grape
Apple  Grape

Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question.

Thank you again!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...