replace

The replace is a function of the eval operator that provides a mechanism to replace the content (expressed as string) of a field and to return the value in a new field. Before using replace, create a query that contains string values in its fields. When using replace, the process transforms the data into temporary tables so that the transformation occurs after the main query is executed.

• Syntax
• Parameters
• How Do I Use This?

Syntax

Name is not null | eval test = replace(Name, “Response”, “Returned Value”)        

where

• Name, Response, and Returned Value are the parameters used in the replacement function

• The replace function is case sensitive. For example, "This," "THIS," and "this" are considered three different words. Match the exact string in order to replace it

Parameters

Replace has three parameters:

• Name, the source string value

• Response, the match value that will be substituted with the returned value in the results

• Returned Value, the replacement value

How Do I Use This?

Use replace when you want to obfuscate data, improve the context of a field, or make reading the text more intuitive.

You can also use the replace function to replace an entire string.

• In this example, use replace to substitute a device’s vendor name with Micro Focus.

  | eval newDeviceVendor = replace ( deviceVendor, "HPE", "Micro Focus")

where:

• DeviceVendor is the source name for the string value.

• HPE is the response value.

• Micro Focus is the returned value.

 

For information about other operators, functions, and syntax requirements, see Use an Operator in the Query.