topic Re: How to edit my regex to replace a number 0-9? in Splunk Search

How to edit my regex to replace a number 0-9?

smaran06 — Mon, 22 May 2017 19:07:23 GMT

Hi Team,

I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with a/b/c{Id}.

When I use regex and use \d its replacing each and every decimal number with {Id} something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}.

I want something like a/b/c{Id}, can you let me know how this can be achieved.

Re: How to edit my regex to replace a number 0-9?

somesoni2 — Mon, 22 May 2017 19:41:10 GMT

Try like this

your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"

your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")

Re: How to edit my regex to replace a number 0-9?

woodcock — Mon, 22 May 2017 21:12:14 GMT

Like this:

|makeresults | eval raw="a/b/c/1234567"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"

Re: How to edit my regex to replace a number 0-9?

smaran06 — Mon, 22 May 2017 23:51:46 GMT

Thanks, this works, can you please let me know, if we need to replace all such formats like below.

a/b/c/464646/d/e/242442424

I want output like this

a/b/c/{Id1}/d/e/{Id2}

Re: How to edit my regex to replace a number 0-9?

woodcock — Tue, 23 May 2017 00:03:26 GMT

You really should be clear from the get-go. This is a very different request.

Re: How to edit my regex to replace a number 0-9?

woodcock — Tue, 23 May 2017 00:10:58 GMT

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

Re: How to edit my regex to replace a number 0-9?

smaran06 — Wed, 24 May 2017 21:03:19 GMT

Thanks this is super helpful, I am able to reduce my spunk query to lot better state.

One last question how this can be achived in case of Alpha Numeric.

I tried something like this.

|rex field=Path mode=sed "s/\w+\d+/{Id}/"

It didn't, help me, please let me know, if I am doing anything wrong here

Re: How to edit my regex to replace a number 0-9?

woodcock — Thu, 25 May 2017 20:29:45 GMT

So you are saying that your {Id} strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters { and } (that will make the modified solution easier)?

Re: How to edit my regex to replace a number 0-9?

smaran06 — Fri, 26 May 2017 06:07:37 GMT

actually my string won't contain any curly braces, it looks like this.

536RTYWW876Y788U998

Re: How to edit my regex to replace a number 0-9?

woodcock — Fri, 26 May 2017 17:07:02 GMT

OK, I updated my answer to accommodate your replacement strings; try it now.