Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
6,000 results
Sorted by:
07-23-2017
04:02 AM
1 Karma
Hello,
I have a lookup file with data in following format
name _time
srv-a.xyz.com 2017.07.23
srv-b.wxyz.com 2017.07.23
I want to replace .xyz.com with w...
Show results in replies (5)
-
The replace function actually is regex. From the most excellent docs on replace: replace(X,Y...
-
You can try this: | replace "*.xyz.com" with "*.wxyz.com" in name
-
...houldn't answer this here, but the answer is the easy "exactly like you'd expect" in that replace doesn't s...
-
...-Enterprise WindowsServer-2008-R2-Enterprise How would we replace all the "-" characters with a...
-
...apturing groups too. You can do things like replace(Field, ".* something ([A-Za-z]+) .*", "\1") . C...
04-07-2021
02:02 PM
Hello, I need to remove the values found (string) from another field. Ex. FIELD1 - abcmailingxyz LIST - mailing, ... Using | eval foundIt=if(match(FIELD1,$LIST$),"X",".") I am able to...
Labels
- Labels:
-
other
09-03-2021
07:18 AM
Hi all, I have an alert that looks for a specific message that includes the record ID. I would like to be able to create a numeric value for that ID that could be used to create a unique ID when ra...
Labels
- Labels:
-
field extraction
-
fields
-
lookup
-
other
-
rex
11-07-2020
06:54 AM
Hi guys, I'm trying to replace values in an irregular multivalue field. I don't want to use mvexpand because I need the field remains multivalue. Here some examples of my multivalues fields #1 1...
06-12-2017
09:31 AM
I had a field of this value
nameSpaces = ["url1"]
nameSpaces = ["url1", "url2"]
I got rex to change ["url1", "url2"] into "url1, url2"
However, I am trying to change url1 to a labe...
06-19-2019
05:38 AM
How can we use case insensitive value in Replace command-
| replace "name" with "entity" in description
will it replace name , NAME, Name, NaMe etc with entity ????
If not how can we i...
11-06-2019
05:00 AM
Background
I have a log file where I have extracted some fields. I am trying to parse a field to get the numeric values it has using replace but it is not working and I don't understand why.
P...
10-29-2020
12:29 AM
Hello everyone, I was wondering if this kind of search is possible. I want to replace the text from my search which looks like this: eventtype=zyxel_user sourcetype="zyxel-fw" msg="Failed login a...
Labels
- Labels:
-
regex
Show results in replies (3)
-
...o Device from ssh \(incorrect password or inexistent username\)/SSH/g" You could also explore the replace...
-
Yes, I could use a lookup command but for now I'm gonna use the replace command :). But in the f...
-
Hi Giuseppe, it's a pleasure to know you! Anyway, if you have to replace many strings, you c...
02-04-2021
09:29 PM
Hello, I have the following situation - in the original files I have the following information in the field: ServerName1 ServerName10 I need to replace the values in the output to be s...
Labels
- Labels:
-
rex
05-24-2021
07:51 AM
...ields using rex command command and not able to move further on how to replace the value in the query . Any help would be appreciated. Thanks in advance. Harris
- Tags:
- regex sed
Labels
- Labels:
-
kvstore
-
Splunk Web Framework
Show results in replies (4)
-
...uery=replace(query,":1",":\"".one."\"") | eval query=replace(query,":2",":\"".two."\"") | eval query=replace...
-
...val expanded=if(count >= <<MATCHSTR>>,replace(expanded," :<<FIELD>&g...
-
...arameter,"") | eval expanded=split(replace(query,":\d+","#"),"#") | eval expanded=mvzip(expanded,p...
-
...ow | foreach param_* [| eval expanded=if(count >= <<MATCHSTR>>,replace(e...
