topic Re: How do I remove a string between the first occurrence of two strings in a query? in Splunk Search

How do I remove a string between the first occurrence of two strings in a query?

Wondergoat77 — Mon, 08 Oct 2018 22:30:14 GMT

I am trying to remove all content returned in a field between two specific strings but only from the first occurrence of these strings.

I need to do this for a few sections of a log, strings I need to replace look like this:

[code= and ] : replace with empty string
[txid= and ] : replace with empty string
"code":"someCode" : either replace with empty string or only replace the "someCode" section.

Example log:

{"status":500,"statusDesc":"Internal Server Error","code":"someCode","message":"some error message"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }

I want the result to be:

 {"status":500,"statusDesc":"Internal Server Error","message":"some error message"}

I am essentially trying to remove unique identifiers from this entry so that I can dedup based on the generic log error.

Re: How do I remove a string between the first occurrence of two strings in a query?

woodcock — Tue, 09 Oct 2018 00:36:07 GMT

Like this:

Your Search Here
| rex "^{(?<curlytext>[^}]+)"
| dedup curlytext

Re: How do I remove a string between the first occurrence of two strings in a query?

MuS — Tue, 09 Oct 2018 01:21:27 GMT

Hi Wondergoat77,

try this rex SPL which uses mode=sed to removes the various strings:

| makeresults 
| eval foo="{\"status\":500,\"statusDesc\":\"Internal Server Error\",\"code\":\"someCode\",\"message\":\"some error message\"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }" 
| rex field=foo mode=sed "s/\[[^\]]+\]|\s\}|\"code\":\"[^\"]+\"//g"

The result looks like this:

Hope this helps ...

cheers, MuS

Re: How do I remove a string between the first occurrence of two strings in a query?

Wondergoat77 — Tue, 09 Oct 2018 15:35:58 GMT

Thanks this did exactly what i needed, much appreciated.

Re: How do I remove a string between the first occurrence of two strings in a query?

MuS — Tue, 09 Oct 2018 18:56:26 GMT

Awesome, feel free to accept the answer so it is marked as answered 😉

cheers, MuS