Splunk Search

Help with JSON regex replace

ballen1
Explorer

Command:

rex mode=sed "s/\"name":\s\"[^\"]+\"/"name":"###############"/g"

Regex seems to work fine in Regex101 

However, I seem to continue to get this error:

Error in 'SearchParser': Missing a search command before '^'. Error at position '69' of search query rex mode=sed "s/\"c...{snipped} {errorcontext = n_id"\s\"[^\"]+\"/"co}'.

I'm trying to mask a json key:value pair.  See below:

"name": "john doe" ----> "name": "######"
Labels (1)
0 Karma

danielcj
Communicator

Hello,

It is missing a after the name and before the ".

The correct one is:

| rex mode=sed "s/\"name\":\s\"[^\"]+\"/"name":"###############"/g"

ballen1
Explorer

Thank you for this.  For some reason I had to add a few more \ to make this work.  See below:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

0 Karma

ballen1
Explorer

Hello,

Thank you for the reply.  That removed that error.  However, it still doesn't mask the "name" field in the search.

"name" still shows as:  

"name": "john doe"

 

0 Karma

ballen1
Explorer

ah.  I figured it out.  I had to modify it like the following for it to replace properly:

“s/\”name\”\:\”[^\”]+\”/\”name\":\"###############\"/g"

This is using splunk cloud btw.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...