replace_string()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Replaces all string matches with a specified string.

Deprecated aliases: replace()

To replace multiple strings, see replace_strings().

Syntax

replace_string(text, lookup, rewrite)

Learn more about syntax conventions.

Parameters

Returns

Returns the text after replacing all matches of lookup with evaluations of rewrite. Matches don't overlap.

Examples

Replace words in a string

The following example uses replace_string() to replace the word "cat" with the word "hamster" in the Message string.

print Message="A magic trick can turn a cat into a dog"
| extend Outcome = replace_string(
        Message, "cat", "hamster")  // Lookup strings

Output

Generate and modify a sequence of numbers

The following example creates a table with column x containing numbers from one to five, incremented by one. It adds the column str that concatenates "Number is " with the string representation of the x column values using the strcat() function. It then adds the replaced column where "was" replaces the word "is" in the strings from the str column.

range x from 1 to 5 step 1
| extend str=strcat('Number is ', tostring(x))
| extend replaced=replace_string(str, 'is', 'was')

Output

Related content

• To replace multiple strings, see replace_strings().
• To replace strings based on regular expression, see replace_regex().
• To replace a set of characters, see translate().