topic Re: How to rex using sed rex command? in Splunk Search

How to rex using sed rex command?

karthi2809 — Tue, 29 Sep 2020 17:39:54 GMT

How to rex using sed rex command?

index = main
| rex field=URI "^(?.+?)(\?|\z)"
|rex field=New_APIName mode=sed "s/\d+[a-zA-Z0-9*]/XXXX/g"
| stats count by New_APIName

I am getting output as

/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX/benefitlist

/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/excluded

Expected result:

/v1/cp/members/XXXX/benefits/XXXX/benefitlist

/v1/cp/members/XXXX/benefits/XXXX/excluded

Re: How to rex using sed rex command?

brettcarroll — Tue, 16 Jan 2018 12:54:34 GMT

Most likely you have a problem with the regular expression.

What are the actual values of XXXX (letters, numbers)?

The regular expression you have is looking for 1 or more digits followed by 0 or more letters or numbers and replacing the matches with XXXX

regex101.com is a good online regex utility to help build regular expressions

Re: How to rex using sed rex command?

493669 — Tue, 16 Jan 2018 13:22:01 GMT

Hi @karthi2809
Try below regex:

 <base search> | rex mode=sed field=New_APIName "s/(^\/\w+\/\w+\/\w+\/\w+\/\w+\/.{4})[^\/]+(\/\w+)/\1\2/"

Re: How to rex using sed rex command?

horsefez — Tue, 16 Jan 2018 13:31:22 GMT

Hi,

try this one

| rex mode=sed field=<yourfield> "s/^(\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\/)[^\/]*(\/[^\/]*)/\1XXXX\2/g"

https://regex101.com/r/rwjLxP/1