Splunk Search

How do I remove a string between the first occurrence of two strings in a query?

Wondergoat77
Engager

I am trying to remove all content returned in a field between two specific strings but only from the first occurrence of these strings.

I need to do this for a few sections of a log, strings I need to replace look like this:

[code= and ] : replace with empty string
[txid= and ] : replace with empty string
"code":"someCode" : either replace with empty string or only replace the "someCode" section.

Example log:

{"status":500,"statusDesc":"Internal Server Error","code":"someCode","message":"some error message"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }

I want the result to be:

 {"status":500,"statusDesc":"Internal Server Error","message":"some error message"}

I am essentially trying to remove unique identifiers from this entry so that I can dedup based on the generic log error.

Tags (3)
0 Karma

MuS
Legend

Hi Wondergoat77,

try this rex SPL which uses mode=sed to removes the various strings:

| makeresults 
| eval foo="{\"status\":500,\"statusDesc\":\"Internal Server Error\",\"code\":\"someCode\",\"message\":\"some error message\"} [code=919285284] [txid=5f6c0952-5184-4bdd-9658-6487dfaeaf3f] }" 
| rex field=foo mode=sed "s/\[[^\]]+\]|\s\}|\"code\":\"[^\"]+\"//g"

The result looks like this:
alt text

Hope this helps ...

cheers, MuS

Wondergoat77
Engager

Thanks this did exactly what i needed, much appreciated.

0 Karma

MuS
Legend

Awesome, feel free to accept the answer so it is marked as answered 😉

cheers, MuS

0 Karma

woodcock
Esteemed Legend

Like this:

Your Search Here
| rex "^{(?<curlytext>[^}]+)"
| dedup curlytext
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...