Splunk Search

Help with JSON regex replace

ballen1
Explorer

Command:

rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

Regex seems to work fine in Regex101 

However, I seem to continue to get this error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'.

I'm trying to mask a json key:value pair.  See below:

"name": "john doe" ----> "name": "######"
Labels (1)
0 Karma

danielcj
Communicator

Hello,

It is missing a after the name and before the ".

The correct one is:

| rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g"

ballen1
Explorer

Thank you for this.  For some reason I had to add a few more \ to make this work.  See below:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

0 Karma

ballen1
Explorer

Hello,

Thank you for the reply.  That removed that error.  However, it still doesn't mask the "name" field in the search.

"name" still shows as:  

"name": "john doe"

 

0 Karma

ballen1
Explorer

ah.  I figured it out.  I had to modify it like the following for it to replace properly:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

This is using splunk cloud btw.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...