topic How to replace Unique Values? in Splunk Search

How to replace Unique Values?

mcscjlf — Mon, 11 Jul 2022 16:41:56 GMT

Hello,

I have several events in the _raw field that add a unique identification number. I would like to replace these with something standard to aggregate counts on.

Example Data:

fi/transaction/card/purchase/tx_2994882028948/refund

fi/transaction/card/purchase/tx_3920496893002/void

fi/transaction/card/purchase/tx_2930540482198/refund

I'd like these all to read:

fi/transaction/card/purchase/trans/refund

fi/transaction/card/purchase/trans/void

fi/transaction/card/purchase/trans/refund

So replace the unique identifier, but maintain the verbiage at the end.

I've tried a few of the other methods noted in other threads, but to no avail. Some don't work at all, some run, but don't replace the values.

Thanks!!

Re: Replace Unique Values

ITWhisperer — Mon, 11 Jul 2022 15:48:14 GMT

If your unique identification number match a common pattern, then you can you rex in sed mode

| rex mode=sed "s/\/tx_\d+\/\/trans\//g"

Re: Replace Unique Values

danielcj — Mon, 11 Jul 2022 15:49:36 GMT

Hello @mcscjlf ,
You could try something like that (assuming that you want to see this data in search-time):

| rex mode=sed field=_raw "s/(\S+)(tx_\S+)(\/\S+)/\1trans\3/g"

You can change the field=_raw to your specific field, if it is being extracted already in a field.

Re: How to replace Unique Values?

mcscjlf — Tue, 12 Jul 2022 16:35:06 GMT

Thanks for the suggestions! Unfortunately, neither worked. I am trying to change this data in the search and only for the search results, I don't want to permanently change the underlying data. Perhaps my other search criteria is affecting the results with the solutions provided.

Search Criteria:

host="Example" sourcetype=Hexflag2 /fi/transaction/* | rex "POST (?<transact>/S+)" | stats county by transact

This returns the example data below, I'm just hoping for a way to condense all of the unique values to something I can rollup into a usage count.

Re: How to replace Unique Values?

ITWhisperer — Tue, 12 Jul 2022 17:07:17 GMT

Firstly, rex mode=sed doesn't change the underlying data permanently, it just modifies the events in the event pipeline.

It looks like I missed a slash out - try this

host="Example" sourcetype=Hexflag2 /fi/transaction/* | rex mode=sed "s/\/tx_\d+\//\/trans\//g" | rex "POST (?<transact>/\S+)" | stats count by transact