Example One
Replace any occurrence of “a” with “b” but the characters preceding “a” and succeeding it are preserved.
...| replace *a* with *b*
Replaces the specified string in the specified fields with the specified new string.
Synopsis
<orig_str> with <new_str> [in <field_list>]
Where:
<orig_str> is the original string you want to replace. <new_str> is the new string you want to replace with. <field_list> is the optional, however highly recommended. Usage Notes
Tip: Even though the field list is optional for this command, Micro Focus strongly recommends that you specify the fields on which the replace operator should act in this command.
If you skip the field list, the replace operator acts on the fields that have been either explicitly defined using the cef, rex, and eval operators preceding the replace command, or any fields that were used in other operator commands that preceded the replace operator command.
For example, the replace command acts on deviceEventCategory in all of the following cases and replaces one instance of “EPS” with “Events”:
...| replace *EPS* with *Events* in deviceEventCategory
...| cef deviceEventCategory | replace *EPS* with *Events*
...| top deviceEventCategory | replace *EPS* with *Events*
To replace the entire string, specify it in full (as it appears in the event). For example, “192.168.35.3”. To replace part of the string, include wildcard character (*) for the part that is not going to change. For example, if the original string (the string you want to replace) is “192.168*”, only the 192.168 part in an event is replaced. The remaining string is preserved. As a result, if an event contains 192.168.35.3, only the first two bytes are replaced. The rest (35.3) will be preserved. Similarly, if the event contains 192.168.DestIP, DestIP will be preserved. However, if the event contains the string 192.168, it will not be replaced.
If both, the original and the new strings contain wildcard characters, the number of wildcard characters in the original string must match the number of wildcard characters in the new string.
...| replace “*.168.*” with “*.XXX.*
If the original or the new string includes a special character such as / or ?, enclose the string in double quotes (“”):
...| replace “/Monitor” with Error
You can replace multiple values for multiple fields in a single operation by separating each expression with a comma (,). Note that you must specify the field list after specifying the “with” expression for all values that you want to replace, as shown in the following example:
...| replace "Arc*" with Micro Focus, "cpu:100" with EPS in deviceVendor, deviceEventClassId
The original string is case-insensitive. Therefore, the string “err” will replace an event that contains “Err”.
Example One
Replace any occurrence of “a” with “b” but the characters preceding “a” and succeeding it are preserved.
...| replace *a* with *b*
Example Two
Replace any occurrence of “a” with “b” without retaining any characters preceding or succeeding “a”.
...| replace *a* with b in name