topic How. to replace string if preceded or followed by particular characters? in Splunk Search

How. to replace string if preceded or followed by particular characters?

firstname — Mon, 22 Aug 2022 15:14:37 GMT

Given the below example events:

Initial event:

[stuff] apple.bean.carrot2donut.57.egg.fish(10) max:311 min 15 avg 101 low:1[stuff]

Result event 1:

[stuff] apple.bean.carrot&donut.&.egg.fish(&) max:& min & avg & low:&[stuff]

Result event 2:

[stuff] apple.bean.carrot2donut.57.egg.fish(&) max:& min & avg & low:&[stuff]

I want to get Result 2 rather than Result 1. I want to replace any series of numbers with an ampersand only if one of three conditions are true. These conditions:

The number series is preceded by a space.
The number series is preceded by a colon.
The number series is preceded by an open parenthesis and followed by a closed parenthesis.

If I use the replace line below, the new variable created will contain Result 1 rather than the Result 2 I desire.

| eval event = replace(_raw, "[0-9]+", "&")

How do I get Result 2 instead?

Re: Replace string if preceded or followed by particular characters?

gcusello — Mon, 22 Aug 2022 15:12:23 GMT

Hi @firstname,

please try with a regex like the following:

Ciao.

Giuseppe

Re: How. to replace string if preceded or followed by particular characters?

ITWhisperer — Tue, 23 Aug 2022 06:20:23 GMT

| rex mode=sed "s/(?<a>\s|\:)(?<b>\d+)/\1\&/g s/\(\d+\)/(\&)/g"

Re: How. to replace string if preceded or followed by particular characters?

firstname — Mon, 22 Aug 2022 16:38:25 GMT

I think this is almost correct. It doesn't seem to catch the parentheses condition. I've tried to omit a closing parenthesis

| rex mode=sed "s/(?<a>\s|\:|\((?<b>\d+)/\1\&/g"

However, Splunk will not allow this search without the closing parenthesis. I see how this is used to have "or" conditions, but is it possible to use such conditions to allow the stated parentheses condition?

Re: How. to replace string if preceded or followed by particular characters?

ITWhisperer — Tue, 23 Aug 2022 06:21:34 GMT

Updated solution - essentially you would need to do two substitutions, but these can be done in the same rex