Splunk Search

Help with JSON regex replace

ballen1
Explorer

Command:

rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

Regex seems to work fine in Regex101 

However, I seem to continue to get this error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'.

I'm trying to mask a json key:value pair.  See below:

"name": "john doe" ----> "name": "######"
Labels (1)
0 Karma

danielcj
Communicator

Hello,

It is missing a after the name and before the ".

The correct one is:

| rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g"

ballen1
Explorer

Thank you for this.  For some reason I had to add a few more \ to make this work.  See below:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

0 Karma

ballen1
Explorer

Hello,

Thank you for the reply.  That removed that error.  However, it still doesn't mask the "name" field in the search.

"name" still shows as:  

"name": "john doe"

 

0 Karma

ballen1
Explorer

ah.  I figured it out.  I had to modify it like the following for it to replace properly:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

This is using splunk cloud btw.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...