Splunk Search

Can I use regex to remove a pipe character from a string?

MikeElliott
Communicator

Hi All,

I am having a problem with my search output. One of the results contains a pipe ( | ) - E.g. bad_domain|www.baddomain.com.

Once run, the search results are passed to a 3rd party tool that uses pipes as formatting options - This rogue pipe is being picked up as a formatting option. I would like to know how to remove, or replace, the pipe in my search results, for example:

bad_domain|www.baddomain.com to bad_domain_www.baddomain.com, or bad_domain-www.baddomain.com.

Can anyone assist?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

View solution in original post

0 Karma

HiroshiSatoh
Champion

try this!

(your search)|eval text=replace(text,"\|","_")

Please change TEXT to field name.

0 Karma

MikeElliott
Communicator

Worked perfectly - Thank you so very much!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...