Splunk Search

replacing values with "*****"

hurryupfool123
Explorer

I have a field "users" that spits out the result "*****" 

I want to replace the ***** with an IP address its actually related to...  i.e.

replace ***** with (12.13.12.13). so that when ever ****** pops up on my table its replaced with the IP's above.

but everytime I search I get a failure stating I can't use consecutive ******  

|replace "*****" with  (12.13.12.13)  

how can I literally reference ***** as a strings instead of SPL thinking I am saying to search anything bc of the ****** 

 

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Please try to escape every * with \. Basically that means “\*\*\*\*\*”. Some cases you must use more than one \ to escape character.
r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Please try to escape every * with \. Basically that means “\*\*\*\*\*”. Some cases you must use more than one \ to escape character.
r. Ismo

hurryupfool123
Explorer

thank you!  don't know why I didn't think of that! 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...