How to replace digits in regex?

Dharani — Thu, 08 Sep 2022 16:46:15 GMT

Hi,

Below is the example for raw log:

20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cust HTTP/1.1#0115ocilpapgap11.op.okobank.com

20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/015-0000004847/cust/api HTTP/1.1#0115dummy value.com

From the above raw logs I need to extract the below fields:

/wapi/v3/gat/cust

/wapi/v3/gat/cust/apis/info/015-000234567

wapi/v3/gat/015-0000004847/cust/api

and it should be extracted and displayed in table/statistics like below format:

/wmpapi/v3/gat/cust

/wapi/v3/gat/cust/apis/info/{Id}

wapi/v3/gat/{Id}/cust/api

Basically in the fields , it should only take alphapets (including that v3) and we should replace digits to {Id} whereever it exist .

Can someone help me on this.

Thanks!

Re: Replace digits in regex

ITWhisperer — Thu, 08 Sep 2022 07:36:29 GMT

| rex \S+\s(?<URL>\S+)\s | rex field=URL mode=sed "s/\/[\d\-]+/\/{Id}/g"

Re: Replace digits in regex

Dharani — Thu, 08 Sep 2022 11:43:52 GMT

Thank you this worked

topic Re: Replace digits in regex in Splunk Search

How to replace digits in regex?

Re: Replace digits in regex

Re: Replace digits in regex