topic Re: Help with JSON regex replace in Splunk Search

Help with JSON regex replace

ballen1 — Thu, 30 Jun 2022 01:57:03 GMT

Command:

rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

Regex seems to work fine in Regex101

However, I seem to continue to get this error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'.

I'm trying to mask a json key:value pair. See below:

"name": "john doe" ----> "name": "######"

Re: Help with JSON regex replace

danielcj — Thu, 30 Jun 2022 04:59:49 GMT

Hello,

It is missing a \ after the name and before the ".

The correct one is:

| rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g"

Re: Help with JSON regex replace

ballen1 — Thu, 30 Jun 2022 13:04:46 GMT

Hello,

Thank you for the reply. That removed that error. However, it still doesn't mask the "name" field in the search.

"name" still shows as:

"name": "john doe"

Re: Help with JSON regex replace

ballen1 — Thu, 30 Jun 2022 14:31:17 GMT

ah. I figured it out. I had to modify it like the following for it to replace properly:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

This is using splunk cloud btw.

Re: Help with JSON regex replace

ballen1 — Fri, 01 Jul 2022 14:55:45 GMT

Thank you for this. For some reason I had to add a few more \ to make this work. See below:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"