topic Re: Regexes and the replace function in Splunk Search

Regexes and the replace function

cphair — Mon, 28 Sep 2020 11:29:21 GMT

Hello,

I'm wondering if there's a way to trim characters from an unknown field value during search. I'm tracking perfmon data with Splunk, and when there are multiple instances of a process, they come in as iexplore#1, iexplore#2, etc. For my particular search, I want to strip any trailing #(number) from the field values and track the combined information about the instances. The replace function should be what I want, but variations on 'replace "^(\w*)#." with $1"' that I've tried don't seem to work. If I knew the process name in advance I could do 'replace "iexplore#" with iexplore', but I don't. Is there a way to do this?

Re: Regexes and the replace function

dwaddle — Wed, 07 Mar 2012 16:49:28 GMT

You could use rex with a SEDCMD, similar to this:

... | rex mode=sed field=process_name "s/#\d+//"

Which is quite similar to what you already have, so I may be barking up the wrong tree...

Re: Regexes and the replace function

cphair — Thu, 08 Mar 2012 13:52:05 GMT

That's the syntax I was looking for. Thanks!

Re: Regexes and the replace function

aapittts — Thu, 21 Feb 2013 22:13:53 GMT

what part of the regex in this example is the replacement string? I need to do something very similar.

Re: Regexes and the replace function

cphair — Mon, 28 Sep 2020 13:22:35 GMT

@aapittts: The part between the first and second slash is the pattern to match, and between the second and third slash is the replacement string. In this case it's empty because I wanted to get rid of the text entirely, but you could have something like field=process_name "s/foo/bar/" which would replace all occurences of foo in process_name with bar.