https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453388#M128330 <P>Like this:</P> <PRE><CODE>... rex field=url mode=sed "s%/interactions/.*/result_data%/interactions/result_data%" </CODE></PRE> Mon, 13 May 2019 02:58:05 GMT woodcock 2019-05-13T02:58:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453385#M128327 <P>Hi, </P> <P>I have the below urls. How can I use the regex to remove the tokens from urls? Looking to remove data between /interactions/ and result_data.</P> <P>sample:<BR /> <A href="https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data">https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data</A></P> <P>output needed:</P> <P><A href="https://test.com:443/test11/interactions/result_data">https://test.com:443/test11/interactions/result_data</A></P> Mon, 13 May 2019 00:12:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453385#M128327 knalla 2019-05-13T00:12:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453386#M128328 <P>Are you looking to replace this as search time?</P> <PRE><CODE>rex field=url "^(?&lt;part1&gt;.*/interactions)/.*/(?&lt;part2&gt;result_data)$" | eval url=part1."/".part2 </CODE></PRE> <P>If you are looking to do this at index time, you will need to use <CODE>SEDCMD</CODE> or transforms to replace the token (<A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Anonymizedata">https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Anonymizedata</A> ).<BR /> In props.conf,</P> <PRE><CODE>SEDCMD-remove_tokens = s/interactions\/.*\/result-data/interactions\/result-data </CODE></PRE> Mon, 13 May 2019 01:09:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453386#M128328 sduff_splunk 2019-05-13T01:09:15Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453387#M128329 <P>Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)</P> <PRE><CODE>| rex field=url "(?&lt;part1&gt;.+\/).+\/(?&lt;part2&gt;.+)" | eval url=part1+part2 </CODE></PRE> Mon, 13 May 2019 02:06:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453387#M128329 burwell 2019-05-13T02:06:25Z https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453388#M128330 <P>Like this:</P> <PRE><CODE>... rex field=url mode=sed "s%/interactions/.*/result_data%/interactions/result_data%" </CODE></PRE> Mon, 13 May 2019 02:58:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-regex-to-replace-string/m-p/453388#M128330 woodcock 2019-05-13T02:58:05Z