Considering a field like :
field=select id from table where id In ["123","12"] limit 1 |
field=select id from table where id="123" limit 1 |
How can I write a query so that all the values in quotes are replaced by a placeholder? For example, an ideal output would be :
field=select id from table where id In ["xxx","xx"] limit |
field=select id from table where id="xxx" limit 1 |
The values within quotes are alphanumeric
Try this:
| makeresults | eval field="select id from table where id In [\"123\",\"12\"] limit 1"
| append [| makeresults | eval field="select id from table where id=\"123\" limit 1"]
| rex mode=sed field=field "s/\"[^\"]+\"/\"XXX\"/g"
| rex mode=sed field=field "s/\"[^\"]+\"/\"XXX\"/g"
I hope this helps!! Consider upvoting/accepting the answer if it helps!!!
Added more SQL Query related use cases to help Community. I have also updated regular expression and made masking more unpredictable for end user.
| makeresults | eval _raw="field
select id from table where id In [\"123\",\"12\"] limit 1
select id,\"Test\" as dummy from table where id=\"123\" limit 1
select id from table where id=\"123\" limit 1
select id,name from table where id = 123 limit 1
select id,name from table where name = \"test\"
select id,name from table where mo_number=\"1234567890\"
select id,name from table where name = 'test'
select id from table where id In [123,12] limit 1
select id from table where name In [\"name1\",\"name2\"] limit 1"
| multikv forceheader=1
| rex mode=sed field=field "s/(?i)where (.*(|\s)[^=])(=|in)\s*(\"[^\"]*\"|'[^']*'|[^\s]*|[\[^\]*])/where \1\3 XXXX/g"
|table _raw field
Thanks
KV
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Try this:
| makeresults | eval field="select id from table where id In [\"123\",\"12\"] limit 1"
| append [| makeresults | eval field="select id from table where id=\"123\" limit 1"]
| rex mode=sed field=field "s/\"[^\"]+\"/\"XXX\"/g"
| rex mode=sed field=field "s/\"[^\"]+\"/\"XXX\"/g"
I hope this helps!! Consider upvoting/accepting the answer if it helps!!!