The replace operator will replace every occurence of a value in a string. From http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions :
This function returns a string formed
by substituting string Z for every
occurrence of regex string Y in string
X. The third argument Z can also
reference groups that are matched in
the regex.
Given your example above, there are a couple of ways to attack it. If you're always wanting to replace the "14" (or whatever) at the beginning, you should be able to take advantage of the fact that replace uses regexes, and do something like:
... | eval A=if(substr(A,1,2)="14",replace(A,"^14","0"),A) | table A
Or you can accomplish the same thing with string concatenation, similar to:
... | eval A=if(substr(A,1,2)="14", "0".substr(A,3), A) | table A
