Splunk Search

How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

xvxt006
Contributor

Hi,

I have URIs like this:

/appliance/detail/v3.0/vendor/3423434erts/fridge
/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small

I want to replace the number part of the URI (3423434erts or 6757dfs32) with XXX (static text) and keep rest of the URI intact.
I tried this below and looks like some syntax error. Can someone help with this?

| rex field=uri mode=sed "s/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/XXX/g" | table uri
0 Karma

jhollfelder_spl
Splunk Employee
Splunk Employee

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1).

In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃

| makeresults
| eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge"
| rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g"

alt text

xvxt006
Contributor

Thank you all. I will try these and mark whatever works.

0 Karma

chimell
Motivator

HI xvxt006
Try this

| rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri
0 Karma

javiergn
SplunkTrust
SplunkTrust

Another approach using replace:

| stats count
| eval uri = "/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small"
| eval uri = replace(uri, "((?:\/[^\/]+){4}\/)[^\/]+(\/.+)", "\1XXX\2")

Jeremiah
Motivator

How about this? The result should be "/appliance/detail/v3.0/vendor/XXX/fridge".

| gentimes start=-1 | eval uri="/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small" | rex mode=sed field=uri "s/(.*\/vendor\/)[^\/]+(\/.*)/\1XXX\2/" | table uri
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...