Splunk Search

How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?



I have URIs like this:


I want to replace the number part of the URI (3423434erts or 6757dfs32) with XXX (static text) and keep rest of the URI intact.
I tried this below and looks like some syntax error. Can someone help with this?

| rex field=uri mode=sed "s/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/XXX/g" | table uri
0 Karma

Splunk Employee
Splunk Employee

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1).

In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃

| makeresults
| eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge"
| rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g"

alt text


Thank you all. I will try these and mark whatever works.

0 Karma


HI xvxt006
Try this

| rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri
0 Karma


Another approach using replace:

| stats count
| eval uri = "/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small"
| eval uri = replace(uri, "((?:\/[^\/]+){4}\/)[^\/]+(\/.+)", "\1XXX\2")


How about this? The result should be "/appliance/detail/v3.0/vendor/XXX/fridge".

| gentimes start=-1 | eval uri="/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small" | rex mode=sed field=uri "s/(.*\/vendor\/)[^\/]+(\/.*)/\1XXX\2/" | table uri
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...