How to replace Unique Values?

[mcscjlf]

Hello, 

I have several events in the _raw field that add a unique identification number. I would like to replace these with something standard to aggregate counts on. 

Example Data:

fi/transaction/card/purchase/tx_2994882028948/refund

fi/transaction/card/purchase/tx_3920496893002/void

fi/transaction/card/purchase/tx_2930540482198/refund

I'd like these all to read: 

fi/transaction/card/purchase/trans/refund

fi/transaction/card/purchase/trans/void

fi/transaction/card/purchase/trans/refund

So replace the unique identifier, but maintain the verbiage at the end. 

I've tried a few of the other methods noted in other threads, but to no avail. Some don't work at all, some run, but don't replace the values.

Thanks!!

[mcscjlf]

Thanks for the suggestions! Unfortunately, neither worked. I am trying to change this data in the search and only for the search results, I don't want to permanently change the underlying data. Perhaps my other search criteria is affecting the results with the solutions provided. 

Search Criteria:

host="Example"  sourcetype=Hexflag2  /fi/transaction/* | rex "POST (?<transact>/S+)" | stats county by transact

This returns the example data below, I'm just hoping for a way to condense all of the unique values to something I can rollup into a usage count.

[ITWhisperer]

Firstly, rex mode=sed doesn't change the underlying data permanently, it just modifies the events in the event pipeline.

It looks like I missed a slash out - try this

host="Example"  sourcetype=Hexflag2  /fi/transaction/*
| rex mode=sed "s/\/tx_\d+\//\/trans\//g"
| rex "POST (?<transact>/\S+)" 
| stats count by transact

[danielcj]

Hello @mcscjlf ,
You could try something like that (assuming that you want to see this data in search-time):

| rex mode=sed field=_raw "s/(\S+)(tx_\S+)(\/\S+)/\1trans\3/g"

You can change the field=_raw to your specific field, if it is being extracted already in a field.

[ITWhisperer]

If your unique identification number match a common pattern, then you can you rex in sed mode

| rex mode=sed "s/\/tx_\d+\/\/trans\//g"