Splunk Search
Highlighted

How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Contributor

Hi,

I have URIs like this:

/appliance/detail/v3.0/vendor/3423434erts/fridge
/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small

I want to replace the number part of the URI (3423434erts or 6757dfs32) with XXX (static text) and keep rest of the URI intact.
I tried this below and looks like some syntax error. Can someone help with this?

| rex field=uri mode=sed "s/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/XXX/g" | table uri
0 Karma
Highlighted

Re: How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Motivator

How about this? The result should be "/appliance/detail/v3.0/vendor/XXX/fridge".

| gentimes start=-1 | eval uri="/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small" | rex mode=sed field=uri "s/(.*\/vendor\/)[^\/]+(\/.*)/\1XXX\2/" | table uri
0 Karma
Highlighted

Re: How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

SplunkTrust
SplunkTrust

Another approach using replace:

| stats count
| eval uri = "/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small"
| eval uri = replace(uri, "((?:\/[^\/]+){4}\/)[^\/]+(\/.+)", "\1XXX\2")
Highlighted

Re: How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Motivator

HI xvxt006
Try this

| rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri
0 Karma
Highlighted

Re: How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Contributor

Thank you all. I will try these and mark whatever works.

0 Karma
Highlighted

Re: How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

Splunk Employee
Splunk Employee

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1).

In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃

| makeresults
| eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge"
| rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g"

alt text