topic How do I replace text within a field with text from another field? in Splunk Search

How do I replace text within a field with text from another field?

cquinney — Thu, 07 Feb 2019 20:47:23 GMT

I have events that contain multiple fields. For example

PARAM1: Thing1
PARAM2: Thing2
PARAM3: Thing3
MESSAGE: Refer to P1 and P2 in conjunction with P3 and escalate as need be.

What I'd like to create is a message that populates with everything in one sentence / field.

For example:

MESSAGE: Refer to Thing1 and Thing2 in conjunction with Thing3 and escalate as need be.

Any suggestions on how to make this happen would be greatly appreciated.

Re: How do I replace text within a field with text from another field?

cpetterborg — Thu, 07 Feb 2019 22:47:35 GMT

I answered this question the other day for someone. I'm going t assume you want to do this at search time, not index time. The other assumption I'm going to make is that these values are all in the same event. And one final assumption is that the event has the same order each time for the parameters that you want to use.

You will want to use the rex command with mode=sed so that it will actually do the substitution inside the value of the Message field. Something like this can do what you want (and this is using data exactly as you have it above. If it is different, adjust):

| makeresults | eval data="PARAM1: Thing1
PARAM2: Thing2
PARAM3: Thing3
MESSAGE: Refer to P1 and P2 in conjunction with P3 and escalate as need be." |
rex mode=sed field=data 
"s/(PARAM1: )(\w+)([\s\S]*PARAM2: )(\w+)([\s\S]*PARAM3: )(\w+)([\s\S]*MESSAGE: )(.*)P1(.*)P2/\1\2\3\4\5\6\7\8\2\9\4/"
| rex mode=sed field=data "s/(PARAM3: )(\w+)([\s\S]*MESSAGE: )(.*)P3/\1\2\3\4\2/"

The rex command is the only real necessary part. The rest is just setting up the data. This is a general case solution given the data that you provided above.

Re: How do I replace text within a field with text from another field?

cquinney — Thu, 07 Feb 2019 23:07:26 GMT

Thank you!