How to ignore or replace a string of a certain value

[ZYSanshou]

So when an upstream error is logged in our splunk it has two fields that contain all the information about the error. So I created a nice little query to show a simple table of the two fields:

stats values(errorMessage) by errorCode

However for one of the error messages in the errorMessage field it can contain an id for the current transaction with the server. So when we scale up and release this table will contain hundreds of values for a single error type. Examples of the types of errors (obviously sanitized without actual data):

errorCode: Not Required, errorMessage: [Error: Not Required] 400: Downgrade for transactionId=00000000000: type=01 country=GB
errorCode: Not Required, errorMessage: [Error: Not Required] 400: Downgrade for transactionId=00000000001: type=01 country=GB
errorCode: Invalid Request Parameters, errorMessage: [Error: Invalid Request Parameters] 400: Value of 30 for field not valid
errorCode: undefined, errorMessage: [Error: undefined] 400: undefined
errorCode: undefined, errorMessage: [Error: undefined] 500: undefined

So I would like the values(errorMessage) to group the first two items as a single entry so if I could create a new variable without the transactionId or replacing it with the same value, the information would be much easier to read and present for error triage in our dashboard because the transaction id is not important for seeing an error trend.

Not super great with Regex but I feel there is something that would work to just find a field of numbers with a specific length and remove them or replace them. Is that possible?

Thanks

[ITWhisperer · Accepted solution]

Try something like this

| rex mode=sed field=errorMessage "s/transactionId=[^:]+:/transactionId=txid:/g"

[ZYSanshou]

That worked. Thanks.