How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

[xvxt006]

Hi,

I have URIs like this:

/appliance/detail/v3.0/vendor/3423434erts/fridge
/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small

I want to replace the number part of the URI (3423434erts or 6757dfs32) with XXX (static text) and keep rest of the URI intact.
I tried this below and looks like some syntax error. Can someone help with this?

| rex field=uri mode=sed "s/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/XXX/g" | table uri

[jhollfelder_spl]

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1).

In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃

| makeresults
| eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge"
| rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g"

[xvxt006]

Thank you all. I will try these and mark whatever works.

[chimell]

HI xvxt006
Try this

| rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri

[javiergn]

Another approach using replace:

| stats count
| eval uri = "/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small"
| eval uri = replace(uri, "((?:\/[^\/]+){4}\/)[^\/]+(\/.+)", "\1XXX\2")

[Jeremiah]

How about this? The result should be "/appliance/detail/v3.0/vendor/XXX/fridge".

| gentimes start=-1 | eval uri="/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small" | rex mode=sed field=uri "s/(.*\/vendor\/)[^\/]+(\/.*)/\1XXX\2/" | table uri