I am looking for replacing "James:bond;sharma" with "James bond sharma"in text box in dashboard.
index=* sourcetype=* $Pattern$
The pattern is the token value for the Text box in Splunk Dashboard.
I want to replace all the special characters with space in token value while searching, as I don't want to search for special characters even if it is provided in text box in Splunk dashboard.
Here's one way you can do it:
| eval data=replace(data,"\W"," ")
| eval data=replace(data,"\ {2,}"," ")
That will remove any non-word characters, swapping for a space. Then replace any sequential spaces with a single space.
index=TEST1 sourcetype=TEST2 |eval Patterns="VNRDUS33_:" | eval Pattern1 = upper(replace(Patterns,"([-:._])"," "))| return Pattern1 | search Pattern1
I am facing issue while trying to search the pattern now.
Replace is working as expected.
What are you using return
for here?
Try rex to change replace special characters with space
| makeresults | eval data="James:bond;sharma" | rex field=data mode=sed "s/(\w+)(:)(\w+)(;)(\w+)/\1 \3 \5/"
James:bond;sharma is the input I have given in text box in dashboard.
And data in text box can be any thing like ram$shyam%hari.
I want to replace every special character with space.
Below is the search query for panel -:
index=* sourcetype=* $Pattern$
where Pattern is the token value used for text box in panel of dashboard
try this then
| rex field=data mode=sed "s/(\w+)([^\w]+)(\w+)([^\w]+)(\w+)/\1 \3 \5/"
this will replace any special character with space