Splunk Search

How to edit my regex to replace a number 0-9?

smaran06
Path Finder

Hi Team,

I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with a/b/c{Id}.

When I use regex and use \d its replacing each and every decimal number with {Id} something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}.

I want something like a/b/c{Id}, can you let me know how this can be achieved.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

0 Karma

smaran06
Path Finder

Thanks this is super helpful, I am able to reduce my spunk query to lot better state.

One last question how this can be achived in case of Alpha Numeric.

I tried something like this.

|rex field=Path mode=sed "s/\w+\d+/{Id}/"

It didn't, help me, please let me know, if I am doing anything wrong here

0 Karma

woodcock
Esteemed Legend

So you are saying that your {Id} strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters { and } (that will make the modified solution easier)?

0 Karma

smaran06
Path Finder

actually my string won't contain any curly braces, it looks like this.

536RTYWW876Y788U998

0 Karma

woodcock
Esteemed Legend

OK, I updated my answer to accommodate your replacement strings; try it now.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/1234567"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"
0 Karma

somesoni2
Revered Legend

Try like this

your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"

OR

your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")
0 Karma

smaran06
Path Finder

Thanks, this works, can you please let me know, if we need to replace all such formats like below.

a/b/c/464646/d/e/242442424

I want output like this

a/b/c/{Id1}/d/e/{Id2}

0 Karma

woodcock
Esteemed Legend

You really should be clear from the get-go. This is a very different request.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...