topic replace string (using map/object) in Splunk Search

replace string (using map/object)

posix — Tue, 17 Nov 2020 20:01:27 GMT

hello,

is there anyway to define a map / object. IE { '123': 'something', '1234', 'anotherThing' } and then replace strings with '123' with 'something' and strings with '1234' with 'anotherThing'?

Re: replace string (using map/object)

thambisetty — Thu, 19 Nov 2020 07:42:24 GMT

your question is not quite clear.

may be you find below is helpful.

|makeresults | eval object="{ '123': 'something', '1234', 'anotherThing' }" | rex mode=sed "s/'123'/'something'/g" field=object | rex mode=sed "s/'1234'/'anotherThing'/g" field=object

Re: replace string (using map/object)

posix — Thu, 19 Nov 2020 07:55:54 GMT

@thambisetty thanks for the response. let me clarify the question.

i have a field called image_name which is a string. the string is like '123_456_789_10'. and i want to decode the string from an object. like this {123: 'something', 456: 'something2', 789: 'something3', 10: 'something5'}

and i wand to replace the values of the image_name field with the values of the object so the string will be like: something_something2_something3_something5.

hopefully this makes it clearer.

Re: replace string (using map/object)

thambisetty — Sun, 22 Nov 2020 06:31:24 GMT

You can do that easily using rex mode=sed. but if you have very large number of replacements then rex would not be a right fit.

using rex if you have small number of replacements:

using kv-store lookup if you have very large number of replacements:

you need to define kv-store lookup
you need to have two fields let's call it: number and text
The kv-store lookup should look like below:

The final search looks like below:

Reason for using kv-store lookup rather csv lookup is to perform lookup against multi value field. lookups are not aware of multivalue fields.