topic Re: I would like to hide some values in field in Splunk Search

How to hide some values in field?

chakuttha — Mon, 03 Oct 2022 18:02:57 GMT

When i have query data result from search in field worker id it show >> domain\worker_id

search result Example ABC\123456 it have domain name front of worker id.

If i would like to deleted only domain ABC\ in field and result show only number of worker id .

Example ABC\123456 >>> 123456

Please recommend how to query in search.

Best Regards,

Re: I would like to hide some values in field

richgalloway — Mon, 03 Oct 2022 17:50:33 GMT

There likely are several ways to do that. Here are a couple

| replace "ABC\" with "" in worker_id

| rex mode=sed field=worker_id "s/ABC\//g"

Re: I would like to hide some values in field

chakuttha — Tue, 04 Oct 2022 02:45:31 GMT

Hi richgalloway

I have try to do following your recommend it not work still show domain name front of worker id.

Re: I would like to hide some values in field

bowesmana — Tue, 04 Oct 2022 03:04:02 GMT

@chakuttha Those instructions from @richgalloway should have been

| rex mode=sed field=worker_id "s/ABC\\\\//g" OR this | replace "ABC\\*" with "*" in worker_id

There is a third option

| eval worker_id=replace(worker_id, "ABC\\\\", "")

Note in the middle one, the '\' character needs to be escaped ONCE for the SPL parser line, whereas in the rex and eval statements, the \ needs to be double escaped, once for the SPL parser line and secondly for the regex parser.

Re: I would like to hide some values in field

johnhuang — Tue, 04 Oct 2022 03:43:47 GMT

The solution posted by @richgalloway should have worked. The assumption is that "worker_id" is the actual fieldname you're trying to normalize, if not, you should change worker_id to the actual fieldname.

A more flexible way to do this esp when you have a multi-domain environment with local accounts is to extract the id with regex:

| rex field=worker_id "(?<worker_id>[^\\]*)$"

Re: I would like to hide some values in field

chakuttha — Tue, 04 Oct 2022 04:26:06 GMT

@bowesmana It work.

Thank you so much. 😄