replace

This command is experimental

Definition

replace replaces a defined value in a defined table column with a new value. The whole value or a portion of it can be replaced with a new value.

Examples

Basics

The basic replace syntax looks like this:

| replace [original value] WITH [new value] IN [table column name]
dpl

You can replace only string values with replace. You also need to write the whole original value so the syntax works correctly.

%dpl
| makeresults
| eval value1 = "John"
| eval value2 = "Doe"
| replace John WITH Jane IN value1
dpl
basic example of replace()

You can also replace numbers. However, the number must be converted to string before using replace.

%dpl
| makeresults
| eval value = "21"
| replace 21 WITH 22 IN value
dpl
example of replacing string number

Replace in All Columns

You can replace the value anywhere in the table without stating the table column’s name by using asterisk.

%dpl
| makeresults count=2
| eval value1 = "localhost", value2 = "localhost"
| replace *localhost WITH test
dpl
example of replacing a value from all table columns

Replace in Different Columns

You can replace repetitive value from different table columns.

%dpl
| makeresults
| eval value1 = "false", value2 = "false"
| replace false WITH true IN value1 value2
dpl
example of replacing the same value from different columns

Replace Different Values in the Column

Currently, replace doesn’t support replacing multiple values from a table column. This will be fixed before the community release.

You can replace more than one different value at the same time from a table column. Use comma to separate different values.

%dpl
| makeresults
| eval value = "1234 Awesome St, 123-45, Fake City"
| replace *1234* WITH *5678*, *Awesome* WITH *Marvelous* IN value
dpl

You also can replace different values from different rows as long as they’re in the same table column.

%dpl
index=crud
| spath _raw
| replace delete WITH DELETE, update WITH UPDATE IN operation
dpl

Replace Partially

You can replace only a part of your string value by using * around the replaceable value and the new value.

%dpl
| makeresults
| eval value = "let's try something hard"
| replace *hard* WITH *easy* IN value
dpl
partial replacement example

Change the Order

You can relocate a value in the value to be at the start or at the end by using asterisk. You can’t relocate values that are in the middle of the character string.

%dpl
| makeresults
| eval value = "abc def ghi", value2 = "abc def ghi"
| replace "abc *" WITH "* abc" IN value
| replace "* ghi" WITH "ghi *" IN value2
| table value, value2
dpl
example of changing the order with replace

Further Reading