Splunk Search

replacing values with "*****"

hurryupfool123
Explorer

I have a field "users" that spits out the result "*****" 

I want to replace the ***** with an IP address its actually related to...  i.e.

replace ***** with (12.13.12.13). so that when ever ****** pops up on my table its replaced with the IP's above.

but everytime I search I get a failure stating I can't use consecutive ******  

|replace "*****" with  (12.13.12.13)  

how can I literally reference ***** as a strings instead of SPL thinking I am saying to search anything bc of the ****** 

 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Please try to escape every * with \. Basically that means “\*\*\*\*\*”. Some cases you must use more than one \ to escape character.
r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Please try to escape every * with \. Basically that means “\*\*\*\*\*”. Some cases you must use more than one \ to escape character.
r. Ismo

hurryupfool123
Explorer

thank you!  don't know why I didn't think of that! 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...