topic Re: How can I replace Parenthesis in a URL field with Dots? in Splunk Search

How can I replace Parenthesis in a URL field with Dots?

yossefn — Thu, 18 Jun 2020 12:23:04 GMT

Hi,

I have a DNS logs with Parenthesis + numbers instead of Dots in the URL filed.

How can I replace them with a Dots?

Below are some examples from the logs.

(5)_ldap(4)_tcp(5)cmp(6)_sites(3)rub(3)net(2)oz(0) (4)wpad(3)rub(3)net(0) (5)_ldap(4)_tcp(2)dc(6)_msdcs(9)dc(7)core(2)t4(3)rub(3)net(0)

Thank you!

Re: How can I replace Parenthesis in a URL field with Dots?

richgalloway — Thu, 18 Jun 2020 12:32:26 GMT

Use SED.

| makeresults | eval data="(5)_ldap(4)_tcp(5)cmp(6)_sites(3)rub(3)net(2)oz(0) (4)wpad(3)rub(3)net(0) (5)_ldap(4)_tcp(2)dc(6)_msdcs(9)dc(7)core(2)t4(3)rub(3)net(0)" | rex field=data mode=sed "s/(\(\d+)\)/./g"

Re: How can I replace Parenthesis in a URL field with Dots?

yossefn — Thu, 18 Jun 2020 12:35:38 GMT

Wow, that was fast 🙂

Thanks @richgalloway for the solution!