https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562847#M196111 <P>Works fine. Thanks for the help</P> Wed, 11 Aug 2021 04:19:58 GMT pjtbasu 2021-08-11T04:19:58Z https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562723#M196076 <P>Hi Team,</P><P>&nbsp;</P><P>I've a field name uri, which has value like this --</P><P>/dev/{AccountNumber}/accountDetail</P><P>/uat/{ContentID}/content</P><P>&nbsp;</P><P>I want to extract one column like, 'uriwithregex' so that I can use it later. The value of uriwithregex will be like&nbsp;</P><P>/dev/*/accountDetail</P><P>/uat/*/content</P><P>So basically want to replace the string with * (Including the curly brackets)</P><P>Could someone please help ?</P> Tue, 10 Aug 2021 11:06:20 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562723#M196076 pjtbasu 2021-08-10T11:06:20Z https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562730#M196078 <P>Try</P><LI-CODE lang="markup">|makeresults|eval urls="/dev/{AccountNumber}/accountDetail /uat/{ContentID}/content" |makemv urls| mvexpand urls |eval uriwithregex=urls |rex field=uriwithregex mode=sed "s/\{.+\}/*/g"</LI-CODE> Tue, 10 Aug 2021 11:39:13 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562730#M196078 renjith_nair 2021-08-10T11:39:13Z https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562847#M196111 <P>Works fine. Thanks for the help</P> Wed, 11 Aug 2021 04:19:58 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-regex-help/m-p/562847#M196111 pjtbasu 2021-08-11T04:19:58Z