Splunk Search

How to edit my regex to replace a number 0-9?

smaran06
Path Finder

Hi Team,

I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with a/b/c{Id}.

When I use regex and use \d its replacing each and every decimal number with {Id} something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}.

I want something like a/b/c{Id}, can you let me know how this can be achieved.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

0 Karma

smaran06
Path Finder

Thanks this is super helpful, I am able to reduce my spunk query to lot better state.

One last question how this can be achived in case of Alpha Numeric.

I tried something like this.

|rex field=Path mode=sed "s/\w+\d+/{Id}/"

It didn't, help me, please let me know, if I am doing anything wrong here

0 Karma

woodcock
Esteemed Legend

So you are saying that your {Id} strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters { and } (that will make the modified solution easier)?

0 Karma

smaran06
Path Finder

actually my string won't contain any curly braces, it looks like this.

536RTYWW876Y788U998

0 Karma

woodcock
Esteemed Legend

OK, I updated my answer to accommodate your replacement strings; try it now.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/1234567"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"
0 Karma

somesoni2
Revered Legend

Try like this

your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"

OR

your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")
0 Karma

smaran06
Path Finder

Thanks, this works, can you please let me know, if we need to replace all such formats like below.

a/b/c/464646/d/e/242442424

I want output like this

a/b/c/{Id1}/d/e/{Id2}

0 Karma

woodcock
Esteemed Legend

You really should be clear from the get-go. This is a very different request.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...