topic Re: replacing parts inside string in Splunk Search

replacing parts inside string

exocore123 — Mon, 12 Jun 2017 16:31:27 GMT

I had a field of this value

nameSpaces = ["url1"] 
nameSpaces = ["url1", "url2"]

I got rex to change ["url1", "url2"] into "url1, url2"
However, I am trying to change url1 to a label1, and url2 to label2, is there a way I can change it so the outcome from
"url1, url2" to "label1, label2"

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 16:32:31 GMT

I saw I can use rex sed mode, but I am a bit confused on mapping the string. Originally I used spath and then replace for the labels, but I noticed they showed up as single records, and messed up the total count for the logs, so I am trying to maintain the proper length of the array. I was thinking rex mode=sed "s/url1/label1"

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 16:43:02 GMT

Try like this

your current search giving field nameSpaces
| rex field=nameSpaces mode=sed "s/url/label/g"

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 16:51:02 GMT

Perfect! what about if I had url1 and url3, and they're both the same, can I somehow condense it to rex field=nameSpaces mode=sed "s/url1 | url3/label/g" as well as multiple fields?

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 17:02:56 GMT

You could do like this

...| rex field=nameSpaces mode=sed "s/(ur1|url3)/label/g"

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 17:07:35 GMT

Thanks! What about field=nameSpaces|nameSpaces2 mode=sed "s/(ur1|url3)/label/g"? Something similar? I tried that and did not work

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 17:19:22 GMT

You can't specify multiple fields in field attribute of rex command. You can either run rex multiple time for each nameSpace field, or use foreach command like this

... | foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 17:28:52 GMT

well technically my nameSpaces are two different fields (name wise), so I guess I am going to have to make duplicate rex lines then, maybe possibly rename?

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 17:33:00 GMT

I accidentally added a space after nameSpace in above foreach command. I'm using * as wildcard so any field which starts with nameSpace will get that replacement.

And yes, other option would be to add multiple rex commands for each nameSpaceN field.

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 18:03:26 GMT

I got an "Unencoded <" error when using foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 18:57:41 GMT

Are you trying to run it from dashboard?

Re: replacing parts inside string

exocore123 — Mon, 12 Jun 2017 20:36:45 GMT

Yeah, in my query on dashboard

Re: replacing parts inside string

somesoni2 — Mon, 12 Jun 2017 21:01:05 GMT

Guessing you're updating the dashboard xml directly, use the foreach like this

...|  foreach nameSpaces* [rex field="&lt;&lt;FIELD&gt;&gt;" mode=sed "s/(url1|url3)/label/g" ]