Splunk Search

How to replace a dynamic string in an event?

marisstella
Explorer

I want to replace a dynamic string in an event..
Example: error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop...

Here "ABCXYZ12345ABCXYZ" is dynamic field. So i want to replace this string with XZXYYZZ"

0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust
...
|rex mode=sed "s/(?<=server )\S+/XZXYYZZ/g"

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust
...
|rex mode=sed "s/(?<=server )\S+/XZXYYZZ/g"

View solution in original post

0 Karma

marisstella
Explorer

I think, we're almost close to resolution..... Let's we have different type of error messages like this, so in every message we want replace one string like CorrelationID, hostname... so how can you replace the string on different error messages and combine as a single field. So that I can use this field anywhere in the dashboard or report?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

correlationID?Hostname?
I don't know.

0 Karma

marisstella
Explorer

No no....I have already replaced majority of the strings based on your regex or idea.
Let's say, I have already wrote regex and able to replace.... Then how do I apply all the replaced strings with single fields...

0 Karma

to4kawa
SplunkTrust
SplunkTrust

all the replaced strings with single fields.
I don't know what these are.

...
 | rex "(?<=server )(?<anyfields>\S+)"
 | eventstats values(anyfields) as anyfields
 | eval single=mvjoin(anyfields,":")

?

0 Karma

marisstella
Explorer

I'm sorry, I'm just confused. How can I apply these changes on _raw data?
When I use the field as | eval _raw=error from server ABCD1234 under lp sy stem.. | rex mode=sed field=error_message "s/(?i)server\s+(\S+)/server xxx-yyy/g"
This is done to _raw, but din't see any changes in the raw data., The Idea is we need to remove the duplicate errors triggering...

0 Karma

to4kawa
SplunkTrust
SplunkTrust

my answer changes _raw.
If rex option field= is not set, this works to _raw.
your query has field=error_message.

0 Karma

marisstella
Explorer

Ohh, thanks!!! It will be very useful for L2 team...

0 Karma

adamsaul
Communicator

Here is the search string I used to test. Please note that field=orig_field will need to be adjusted to whatever the field name is in question, can even be _raw

| makeresults | eval orig_field="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
| rex mode=sed field=orig_field "s/(?i)server\s+(\S+)\s+under/XZXYYZZ/g"

0 Karma

marisstella
Explorer

Thanks for quick response, it is working fine... But I have around 300 different error messages, for all of then I want to replace a string it may be correlationID, Hostname,etc... Using your query, I will replace the string but the field name should be the same for all of 300 messages. How can I achieve this?

0 Karma

marisstella
Explorer

| makeresults | eval origin="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
|append[makeresults|eval origin="error occurred from the server SDFDKJ54121XV under lenderprice hop"]| rex mode=sed field=origin "s/(?i)server\s+(\S+)\s+under/server xxx-yyy under/g"

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!