How to edit my regex to replace a number 0-9?

[smaran06]

Hi Team,

I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with a/b/c{Id}.

When I use regex and use \d its replacing each and every decimal number with {Id} something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}.

I want something like a/b/c{Id}, can you let me know how this can be achieved.

[woodcock · Accepted solution]

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

[smaran06]

Thanks this is super helpful, I am able to reduce my spunk query to lot better state.

One last question how this can be achived in case of Alpha Numeric.

I tried something like this.

|rex field=Path mode=sed "s/\w+\d+/{Id}/"

It didn't, help me, please let me know, if I am doing anything wrong here

[woodcock]

So you are saying that your {Id} strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters { and } (that will make the modified solution easier)?

[smaran06]

actually my string won't contain any curly braces, it looks like this.

536RTYWW876Y788U998

[woodcock]

OK, I updated my answer to accommodate your replacement strings; try it now.

[woodcock]

Like this:

|makeresults | eval raw="a/b/c/1234567"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"

[somesoni2]

Try like this

your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"

OR

your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")

[smaran06]

Thanks, this works, can you please let me know, if we need to replace all such formats like below.

a/b/c/464646/d/e/242442424

I want output like this

a/b/c/{Id1}/d/e/{Id2}

[woodcock]

You really should be clear from the get-go. This is a very different request.