Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
6,000 results
Sorted by:
07-23-2017
04:02 AM
1 Karma
Hello, I have a lookup file with data in following format
name _time srv-a.xyz.com 2017.07.23 srv-b.wxyz.com 2017.07.23
I want to replace .xyz.com with wxyz.com
My replace query does this c...
Labels
- Labels:
-
other
Show results in replies (9)
-
The replace function actually is regex. From the most excellent docs on replace: replace(X,Y...
-
I tried: | makeresults count=10 | eval src=random().".wxyz.com" | eval name = replace(s...
-
...apturing groups too. You can do things like replace(Field, ".* something ([A-Za-z]+) .*", "\1") . C...
-
...houldn't answer this here, but the answer is the easy "exactly like you'd expect" in that replace doesn't s...
-
You could do |rex mode=sed field=field "s/-/ /g"
-
...-Enterprise WindowsServer-2008-R2-Enterprise How would we replace all the "-" characters with a...
-
I just used this and it did exactly what I wanted, put it at the end of my search and I didn't need...
-
Thank you Rich ! I overlooked the wildcard for any single character.
-
You can try this: | replace "*.xyz.com" with "*.wxyz.com" in name
04-07-2021
02:02 PM
Hello, I need to remove the values found (string) from another field. Ex. FIELD1 - abcmailingxyz LIST - mailing, ... Using | eval foundIt=if(match(FIELD1,$LIST$),"X",".") I am able to...
Labels
- Labels:
-
other
03-10-2023
07:20 AM
Hi
Has anyone seen this before, I'm using DB connect to pull data in from a MySQL db, and this is the results shown in the data lab
but the raw events have the training zero's replaced w...
Labels
- Labels:
-
data
09-03-2021
07:18 AM
Hi all, I have an alert that looks for a specific message that includes the record ID. I would like to be able to create a numeric value for that ID that could be used to create a unique ID when ra...
Labels
- Labels:
-
field extraction
-
fields
-
lookup
-
other
-
rex
11-07-2020
06:54 AM
Hi guys, I'm trying to replace values in an irregular multivalue field. I don't want to use mvexpand because I need the field remains multivalue. Here some examples of my multivalues fields #1 1...
11-16-2022
01:41 PM
...3d6e06734ae
}
I want to replace the ids into https://mywebsite/v1/organization/{id}/buildings
I tried {base search string} | eval endpoint=replace(properties.url, "\d+", "{id}") | stats by endpoint&n...
Labels
- Labels:
-
eval
09-07-2022
11:59 PM
...d}
wapi/v3/gat/{Id}/cust/api
Basically in the fields , it should only take alphapets (including that v3) and we should replace digits to {Id} whereever it exist .
Can someone h...
Labels
- Labels:
-
field extraction
-
fields
-
stats
-
timechart
06-12-2017
09:31 AM
I had a field of this value
nameSpaces = ["url1"]
nameSpaces = ["url1", "url2"]
I got rex to change ["url1", "url2"] into "url1, url2"
However, I am trying to change url1 to a labe...
06-19-2019
05:38 AM
How can we use case insensitive value in Replace command-
| replace "name" with "entity" in description
will it replace name , NAME, Name, NaMe etc with entity ????
If not how can we i...
11-06-2019
05:00 AM
Background
I have a log file where I have extracted some fields. I am trying to parse a field to get the numeric values it has using replace but it is not working and I don't understand why.
P...
