Splunk Search

replace String issue

maxmukimov
Explorer

Hello!
I’m trying to replace product codes with product names like
| replace “A1” with “Apple”, “A2” with “Grape”, “A3” with “ Watermelon”
I’m getting what I want except when there are more than one value in Product code field.
Apple
Grape
A1 | A2
How can I fix the row with multiple values?
Thank you.

Labels (1)
0 Karma
1 Solution

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

View solution in original post

efavreau
Motivator

Hi @maxmukimov!

You'll need to give us more detail, like a sample of your logs (with any sensitive information taken out). Otherwise, I'm thinking the mvexpand command would you help in this situation. https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Mvexpand

###

If this reply helps you, an upvote would be appreciated.

###

If this reply helps you, an upvote would be appreciated.

maxmukimov
Explorer

Thank you @efavreau !

I wasn’t able to use mvexpand but the link you advised suggested See Also split function. I realized that “A1 | A2” coming as one String and that’s why

|replace “A1” with “Apple”

wasn’t recognizing “A1 | A2”, what I did was, I added

| eval product=split(product, “ | “)

And now I’m getting the result I wanted.

Apple
Grape
Apple  Grape

Now I have to figure out how to add “Multiple products” text if there are more than one product, but I’ll open separate question.

Thank you again!

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...