topic Re: How to Parse response string value? in Splunk Search

How to Parse response string value?

pmjoen — Mon, 25 Apr 2022 20:43:43 GMT

I have a log I am am trying to parse one of the responses

Field Value

Test Response

Response Test

Testing_Response

For the value "Testing_Response" I would like it to display "Testing" in the results.

Re: How to Parse response string value?

bowesmana — Tue, 26 Apr 2022 00:32:56 GMT

You can rename fields like this

| rename Testing_Response as Testing

or if you are talking about changing the value of a field then there are various ways, but try this

| eval your_field=if(your_field="Testing_Response", "Testing", your_field)

Re: How to Parse response string value?

pmjoen — Tue, 26 Apr 2022 15:56:27 GMT

In this scenario, the data is similar to this:

Document A

Document B

Document C_1425

Document C_2235

Document C_5134

I am grouping them together but due to the _number changing not matching it wont group them and I am looking to remove the _number from each one.

Re: How to Parse response string value?

bowesmana — Tue, 26 Apr 2022 23:38:07 GMT

Here are two ways, using regex to do that

so, you can either use replace() or rex mode=sed

Either way, you are defining the regex to remove what you don't want

Re: How to Parse response string value?

pmjoen — Wed, 27 Apr 2022 15:52:10 GMT

As the value Document C_2235 would grow exponentially, would your example require me to enter all values?

Re: How to Parse response string value?

pmjoen — Wed, 27 Apr 2022 17:37:37 GMT

Resolved with following:

replace “Document C_*” with “Document C” in <field name>

Re: How to Parse response string value?

bowesmana — Wed, 27 Apr 2022 22:42:15 GMT

I think you misunderstood the post - the search I gave was an example showing you how it works using your data. However, the solution is just the replace or rex statement - this regex is simply using a regular expression to remove the bits you don't want - i.e. _ followed by one or more numbers to the end of the string.

| eval Data_Method_1=replace(Data, "_\d+$", "")

Change 'Data' to your field name