Getting Data In

using rex mode="sed" to remove strings surrounded by # characters

idjagger
Engager

Hi,

I have a series of log entries that are in the form

#4 MyApp\Framework\DB\Adapter\Pdo\Mysql->_query('SELECT `store_we...', array()) called at [vendor/myapp/framework/DB/Adapter/Pdo/Mysql.php:621]
#5 MyApp\Framework\DB\Adapter\Pdo\Mysql->query(MyApp\Framework\DB\Select#b8e969b2c2d6#, array()) called at [vendor/myapp/zendframework1/library/Zend/Db/Adapter/Abstract.php:737]
#6 Zend_Db_Adapter_Abstract->fetchAll(MyApp\Framework\DB\Select#b8e969b2c2d6#) called at [vendor/myapp/module-store/App/Config/Source/RuntimeConfigSource.php:87]

where the bits between # and # are the only differences between them.

I wanted to use sed to replace the bits between # and # with a common string so when I do a stats on them they all appear the same and I can get a nice count of how often the error occurred.

I've tried using

rex field=Message mode=sed "s/(Select\#[^\#]*\#)/Select/g"

What would I need to do to replace the portions between the # and # (in this case #b8e969b2c2d6#

Thanks,

Kind regards,

Ian

Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
| rex mode=sed "s/Select#.*?#/Select/g"

just try it.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| rex mode=sed "s/Select#.*?#/Select/g"

just try it.

0 Karma

jpolvino
Builder

Here is one way to do it, using a Run Anywhere example:

| makeresults 
| eval raw="#4 MyApp\Framework\DB\Adapter\Pdo\Mysql->_query('SELECT `store_we...', array()) called at [vendor/myapp/framework/DB/Adapter/Pdo/Mysql.php:621]:::#5 MyApp\Framework\DB\Adapter\Pdo\Mysql->query(MyApp\Framework\DB\Select#b8e969b2c2d6#, array()) called at [vendor/myapp/zendframework1/library/Zend/Db/Adapter/Abstract.php:737]:::#6 Zend_Db_Adapter_Abstract->fetchAll(MyApp\Framework\DB\Select#b8e969b2c2d6#) called at [vendor/myapp/module-store/App/Config/Source/RuntimeConfigSource.php:87]"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| rex field=_raw mode=sed "s/(#.+?#)([^#]+)(#.*)/\1StaticText\3/g"

What this does is break up eligible events into 3 parts, substituting the second part with StaticText.

You can see the regex here: Regex101

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...