https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202460#M58744 <P>It's numeric or alfa-numberic with special structure</P> Wed, 07 Oct 2015 17:44:48 GMT 0range 2015-10-07T17:44:48Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202455#M58739 <P>Hello everyone.</P> <P>I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 and so one.</P> <P>For example, I need these transformations:<BR /> <CODE>/bar/1233131/foo</CODE> -&gt; <CODE>/bar/id/foo</CODE><BR /> <CODE>/bar/12313</CODE> -&gt; <CODE>/bar/id</CODE><BR /> <CODE>/foo/a2b-b2a/bar</CODE> -&gt; <CODE>/foo/id/bar</CODE></P> <P>How can I do it in Splunk?</P> Tue, 01 Sep 2015 09:18:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202455#M58739 0range 2015-09-01T09:18:23Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202456#M58740 <P>Try this:</P> <PRE><CODE>... | rex field=text mode=sed "s/(\/.*?\/)([^\/]*)($|\/.*)/\1id\3/" | ... </CODE></PRE> Tue, 01 Sep 2015 12:25:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202456#M58740 richgalloway 2015-09-01T12:25:35Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202457#M58741 <P>Is the ID you're looking to substitute always just two directories deep? Or can it be 3, 4, 5+ sub-directories deep?</P> Tue, 01 Sep 2015 13:14:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202457#M58741 jkat54 2015-09-01T13:14:10Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202458#M58742 <P>In general, it can be at any level </P> Wed, 02 Sep 2015 07:18:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202458#M58742 0range 2015-09-02T07:18:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202459#M58743 <P>If the ID can be at any level, how is it distinguished from the rest of the file path?</P> Wed, 02 Sep 2015 12:55:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202459#M58743 richgalloway 2015-09-02T12:55:12Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202460#M58744 <P>It's numeric or alfa-numberic with special structure</P> Wed, 07 Oct 2015 17:44:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202460#M58744 0range 2015-10-07T17:44:48Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202461#M58745 <PRE><CODE>| rex field=operation mode=sed "s/([0-9a-z]+\-)+[0-9a-z]+/id/" </CODE></PRE> <P>Works fine:) thank you!</P> Thu, 08 Oct 2015 06:55:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-part-of-a-string-matching-a-certain-regex-for/m-p/202461#M58745 0range 2015-10-08T06:55:49Z