I have a lookup file with data in following format
I want to replace .xyz.com with wxyz.com
My replace query does this correctly for values which end with .xyz.com. However for values ending with .wxyz.com it adds an extra . (dot) to the result.
| eval name = replace(name,".xyz.com", ".wxyz.com")
So the final output looks like :
why is that ? Any help on this highly appreciated. Thanks
replace function actually is regex. From the most excellent docs on replace:
replace(X,Y,Z) - This function returns a string formed by substituting string Z for every occurrence of regex string Y in string X. The third argument Z can also reference groups that are matched in the regex.
Z portions are just strings, so in there a period is just a period, right?
Y is a REGEX, and regular expressions use the dot as a wildcard for "any single character".
That means in
replace(name,".xyz.com", ".wxyz.com") you are replacing every occurance of
<any single character>xyz<any single character>com with ".wxyz.com".
If you want to use replace with literally what you wrote, just escape the periods by putting a backslash in front of them.
| eval name = replace(name,"\.xyz\.com", ".wxyz.com")
Here's a run-anywhere with it fixed. To watch it not work right, just remove the backslashes!
| makeresults | eval src=".wxyz.com" | eval name = replace(src,"\.xyz\.com", ".wxyz.com")
Thanks! It really is a full regular-expression substitution (using "extended" syntax) -- with capturing groups too. You can do things like
replace(Field, ".* something ([A-Za-z]+) .*", "\1"). Character-classes (like
[[:alnum:]]) do not seem to work, but that's less important.
I just used this and it did exactly what I wanted, put it at the end of my search and I didn't need to add extra stuff. Hence the point from me.
Thank you. What if we have multiple occurrences of a string?
How would we replace all the "-" characters with a space?
You would probably better be served by creating a new question.
In fact, I probably shouldn't answer this here, but the answer is the easy "exactly like you'd expect" in that replace doesn't stop at the first match. Here's a run-anywhere.
| makeresults | eval test1 = "WindowsServer-2008-R2-Enterprise" | eval test2 = replace(test1, "-", "")