Replacing a value in all of the fields using a wildcard

The following example replaces a value in all of the fields in the search results. Any value in any field that ends with localhost is replaced with simply localhost.

... | replace str="*localhost" replacement="localhost"

Replacing the value in a specific field

The following example replaces a value in a specific field in the search results. The IP address is replaced with a more descriptive name in the host field.

... | replace str="127.0.0.1" replacement="localhost" host

Replacing the same value in multiple fields

The following example changes a value in two fields in the search results, the start_month and end_month fields.

... | replace str="aug" replacement="August" start_month, end_month

Changing the order of values in a field using wildcards

The following example changes the order of string values in the search results that contain the word localhost so that the string "localhost" precedes the other strings in the host field.

... | replace str="* localhost" replacement="localhost *" host

Replacing fields with empty string values with a value

The following example replaces empty strings in the search results with "None" in the errmsg field.

... | replace str="" replacement="None" errmsg

See also