replace command: Examples

Examples for using the SPL2 replace command.

Replacing a value in all of the fields using a wildcard

The following example replaces a value in all of the fields in the search results. Any value in any field that ends with localhost is replaced with simply localhost. 

... | replace str="*localhost" replacement="localhost"

Replacing the value in a specific field

The following example replaces a value in a specific field in the search results. The IP address is replaced with a more descriptive name in the host field. 

... | replace str="127.0.0.1" replacement="localhost" host

Replacing the same value in multiple fields

The following example changes a value in two fields in the search results, the start_month and end_month fields. 

... | replace str="aug" replacement="August" start_month, end_month

Changing the order of values in a field using wildcards

The following example changes the order of string values in the search results that contain the word localhost so that the string "localhost" precedes the other strings in the host field. 

... | replace str="* localhost" replacement="localhost *" host

Replacing fields with empty string values with a value

The following example replaces empty strings in the search results with "None" in the errmsg field. 

... | replace str="" replacement="None" errmsg
Note: This example will not work unless you have values that are actually the empty string, which is not the same as not having a value.

See also

replace command

replace command: Overview, syntax, and usage