https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479149#M143225 <P>Thanks for quick response, it is working fine... But I have around 300 different error messages, for all of then I want to replace a string it may be correlationID, Hostname,etc... Using your query, I will replace the string but the field name should be the same for all of 300 messages. How can I achieve this?</P> Wed, 26 Feb 2020 01:39:53 GMT marisstella 2020-02-26T01:39:53Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479147#M143223 <P>I want to replace a dynamic string in an event..<BR /> Example: error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop...</P> <P>Here "ABCXYZ12345ABCXYZ" is dynamic field. So i want to replace this string with XZXYYZZ"</P> Tue, 25 Feb 2020 17:59:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479147#M143223 marisstella 2020-02-25T17:59:57Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479148#M143224 <P>Here is the search string I used to test. Please note that <CODE>field=orig_field</CODE> will need to be adjusted to whatever the field name is in question, can even be <CODE>_raw</CODE></P> <P><CODE>| makeresults | eval orig_field="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"<BR /> | rex mode=sed field=orig_field "s/(?i)server\s+(\S+)\s+under/XZXYYZZ/g"</CODE></P> Tue, 25 Feb 2020 18:25:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479148#M143224 adamsaul 2020-02-25T18:25:43Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479149#M143225 <P>Thanks for quick response, it is working fine... But I have around 300 different error messages, for all of then I want to replace a string it may be correlationID, Hostname,etc... Using your query, I will replace the string but the field name should be the same for all of 300 messages. How can I achieve this?</P> Wed, 26 Feb 2020 01:39:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479149#M143225 marisstella 2020-02-26T01:39:53Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479150#M143226 <P>| makeresults | eval origin="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop" <BR /> |append[makeresults|eval origin="error occurred from the server SDFDKJ54121XV under lenderprice hop"]| rex mode=sed field=origin "s/(?i)server\s+(\S+)\s+under/server xxx-yyy under/g" </P> Wed, 26 Feb 2020 03:09:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479150#M143226 marisstella 2020-02-26T03:09:57Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479151#M143227 <PRE><CODE>... |rex mode=sed "s/(?&lt;=server )\S+/XZXYYZZ/g" </CODE></PRE> Wed, 26 Feb 2020 09:46:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479151#M143227 to4kawa 2020-02-26T09:46:01Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479152#M143228 <P>I think, we're almost close to resolution..... Let's we have different type of error messages like this, so in every message we want replace one string like CorrelationID, hostname... so how can you replace the string on different error messages and combine as a single field. So that I can use this field anywhere in the dashboard or report?</P> Wed, 26 Feb 2020 10:05:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479152#M143228 marisstella 2020-02-26T10:05:33Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479153#M143229 <P>correlationID?Hostname?<BR /> I don't know.</P> Wed, 26 Feb 2020 10:12:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479153#M143229 to4kawa 2020-02-26T10:12:57Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479154#M143230 <P>No no....I have already replaced majority of the strings based on your regex or idea. <BR /> Let's say, I have already wrote regex and able to replace.... Then how do I apply all the replaced strings with single fields...</P> Wed, 26 Feb 2020 10:50:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479154#M143230 marisstella 2020-02-26T10:50:47Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479155#M143231 <P><CODE>all the replaced strings with single fields.</CODE><BR /> I don't know what these are.</P> <PRE><CODE>... | rex "(?&lt;=server )(?&lt;anyfields&gt;\S+)" | eventstats values(anyfields) as anyfields | eval single=mvjoin(anyfields,":") </CODE></PRE> <P>?</P> Wed, 26 Feb 2020 11:10:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479155#M143231 to4kawa 2020-02-26T11:10:20Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479156#M143232 <P>I'm sorry, I'm just confused. How can I apply these changes on _raw data?<BR /> When I use the field as | eval _raw=error from server ABCD1234 under lp sy stem.. | rex mode=sed field=error_message "s/(?i)server\s+(\S+)/server xxx-yyy/g" <BR /> This is done to _raw, but din't see any changes in the raw data., The Idea is we need to remove the duplicate errors triggering... </P> Wed, 30 Sep 2020 04:25:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479156#M143232 marisstella 2020-09-30T04:25:18Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479157#M143233 <P>my answer changes _raw.<BR /> If <CODE>rex</CODE> option <CODE>field=</CODE> is not set, this works to _raw.<BR /> your query has <CODE>field=error_message</CODE>.</P> Wed, 30 Sep 2020 04:21:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479157#M143233 to4kawa 2020-09-30T04:21:52Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479158#M143234 <P>Ohh, thanks!!! It will be very useful for L2 team...</P> Thu, 27 Feb 2020 11:42:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-a-dynamic-string-in-an-event/m-p/479158#M143234 marisstella 2020-02-27T11:42:06Z