|This command is experimental|
replace replaces a defined value in a defined table column with a new value. The whole value or a portion of it can be replaced with a new value.
replace syntax looks like this:
| replace [original value] WITH [new value] IN [table column name]
You can replace only string values with
replace. You also need to write the whole original value so the syntax works correctly.
%dpl | makeresults | eval value1 = "John" | eval value2 = "Doe" | replace John WITH Jane IN value1
You can also replace numbers. However, the number must be converted to string before using
%dpl | makeresults | eval value = "21" | replace 21 WITH 22 IN value
You can replace the value anywhere in the table without stating the table column’s name by using asterisk.
%dpl | makeresults count=2 | eval value1 = "localhost", value2 = "localhost" | replace *localhost WITH test
You can replace repetitive value from different table columns.
%dpl | makeresults | eval value1 = "false", value2 = "false" | replace false WITH true IN value1 value2
You can replace more than one different values at the same time from a table column. Use comma to separate different values.
%dpl | makeresults | eval value = "1234 Awesome St, 123-45, Fake City" | replace *1234* WITH *5678*, *Awesome* WITH *Marvelous* IN value
You also can replace different values from different rows as long as they are in the same table column.
%dpl index=crud | spath _raw | replace delete WITH DELETE, update WITH UPDATE IN operation
You can replace only a part of your string value by using
* around the replaceable value and the new value.
%dpl | makeresults | eval value = "let's try something hard" | replace *hard* WITH *easy* IN value
You can relocate a value in the value to be at the start or at the end by using asterisk. You can’t relocate values that are in the middle of the character string.
%dpl | makeresults | eval value = "abc def ghi", value2 = "abc def ghi" | replace "abc *" WITH "* abc" IN value | replace "* ghi" WITH "ghi *" IN value2 | table value, value2