Splunk Search

How to globally replace a value in any of the fields.

jiaqya
Builder

i have a output where i have 0 in random columns.
i would like these 0's to be replaced with any text for reporting...

is it possible to replace 0 in any field ? ex output below

Jan2019 Feb2019 Mar2019 Apr2019
0 1 8 10
1 20 3 40
9 1 0 4

the above should change to
Jan2019 Feb2019 Mar2019 Apr2019
NA 1 8 10
1 20 3 40
9 1 NA 4

there are also 0's in other cells but they are not =0, but 10 ,40 , 20 etc...
but only =0 should be replaced, thanks for the response in advance..

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried | replace 0 with "NA" | ?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @jiaqya,

Try this:

| foreach Jan2019,Feb2019,Mar2019,Apr2019 [ eval <<FIELD>>=if(<<FIELD>>==0, "NA", <<FIELD>>)]

If the interested fields contains same string in their names:

| foreach *2019 [ eval <<FIELD>>=if(<<FIELD>>==0, "NA", <<FIELD>>)]

Sample query:

| makeresults 
| eval _raw="Jan2019,Feb2019,Mar2019,Apr2019
0,1,8,10
1,20,3,40
9,1,0,4" 
| multikv forceheader=1 
| fields - _time,_raw,linecount 
| foreach Jan2019,Feb2019,Mar2019,Apr2019 
    [ eval <<FIELD>>=if(<<FIELD>>==0, "NA", <<FIELD>>)]
0 Karma

jiaqya
Builder

i do have my solution by using replace 0 as NA

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried | replace 0 with "NA" | ?

---
If this reply helps you, Karma would be appreciated.

jiaqya
Builder

This will replace the other 0 also to NA, like in 20,40 etc... and the column names are dynamic...

0 Karma

anmolpatel
Builder

richgalloway's solution will work. replace will not modify values like in 20, 40 etc. That will only happen if you specify |replace *0 with "NA"

0 Karma

jiaqya
Builder

Right, i was trying rex before and it was replacing 0 as NA everywhere it found.

with replace 0 with "NA" , it is only replacing the 0 , and not the 20/40
thanks, this solves my problem.

john.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...