Splunk Search

How do I extract a substring from an existing field value, but ignore any strings containing a particular character (%2)?

pradjswl
Explorer

How do I extract a substring from a field value, ignoring a word containing a particular character, let's say %2.

Original field value = some text here GVtghrUaE%2FIU5H 8Lpa%2FcfAhIZvdT7Q1Q %2F4UL3zgnngrOrL97eUYn5e0 j8sXk5eN6%2FSQEsVAz066qk%2 some more text here

New extracted field value = some text here some more text here

Thank you for your help.

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

| rex field=yourfield mode=sed "s/\S*%2\S*//g"

Of if you want to keep the original one simply do this instead:

| eval newfield = oldfield
| rex field=newfield mode=sed "s/\S*%2\S*//g"

Example:

| makeresults | fields - _time
| eval _raw = "some text here GVtghrUaE%2FIU5H 8Lpa%2FcfAhIZvdT7Q1Q %2F4UL3zgnngrOrL97eUYn5e0 j8sXk5eN6%2FSQEsVAz066qk%2 some more text here"
| rex mode=sed "s/\S*%2\S*//g"

Output (see picture below):

alt text

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this:

| rex field=yourfield mode=sed "s/\S*%2\S*//g"

Of if you want to keep the original one simply do this instead:

| eval newfield = oldfield
| rex field=newfield mode=sed "s/\S*%2\S*//g"

Example:

| makeresults | fields - _time
| eval _raw = "some text here GVtghrUaE%2FIU5H 8Lpa%2FcfAhIZvdT7Q1Q %2F4UL3zgnngrOrL97eUYn5e0 j8sXk5eN6%2FSQEsVAz066qk%2 some more text here"
| rex mode=sed "s/\S*%2\S*//g"

Output (see picture below):

alt text

pradjswl
Explorer

ty @javiergn

How do i make this field extracted and present all the time in interesting filed, instead of making this as search time extraction.
(?P) format of regular expression.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Take a look at this link where it explains how to anonymize data either at index time (SEDCMD) or search-time. It's pretty much your use case but instead of replacing the content with # you just want to hide it:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Anonymizedata

Let me know if that's not clear enough.

By the way, if you are happy with the answer please don't forget to mark it as such so that we can close the thread.

Regards,
J

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...