Splunk Search

How do I remove a string between the first occurrence of two strings in a query?

Wondergoat77
Engager

I am trying to remove all content returned in a field between two specific strings but only from the first occurrence of these strings.

I need to do this for a few sections of a log, strings I need to replace look like this:

[code= and ] : replace with empty string
[txid= and ] : replace with empty string
"code":"someCode" : either replace with empty string or only replace the "someCode" section.

Example log:

{"status":500,"statusDesc":"Internal Server Error","code":"someCode","message":"some error message"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }

I want the result to be:

 {"status":500,"statusDesc":"Internal Server Error","message":"some error message"}

I am essentially trying to remove unique identifiers from this entry so that I can dedup based on the generic log error.

Tags (3)
0 Karma

MuS
Legend

Hi Wondergoat77,

try this rex SPL which uses mode=sed to removes the various strings:

| makeresults 
| eval foo="{\"status\":500,\"statusDesc\":\"Internal Server Error\",\"code\":\"someCode\",\"message\":\"some error message\"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }" 
| rex field=foo mode=sed "s/\[[^\]]+\]|\s\}|\"code\":\"[^\"]+\"//g"

The result looks like this:
alt text

Hope this helps ...

cheers, MuS

Wondergoat77
Engager

Thanks this did exactly what i needed, much appreciated.

0 Karma

MuS
Legend

Awesome, feel free to accept the answer so it is marked as answered 😉

cheers, MuS

0 Karma

woodcock
Esteemed Legend

Like this:

Your Search Here
| rex "^{(?<curlytext>[^}]+)"
| dedup curlytext
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...