Splunk Search

How to replace a dynamic string in an event?

marisstella
Explorer

I want to replace a dynamic string in an event..
Example: error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop...

Here "ABCXYZ12345ABCXYZ" is dynamic field. So i want to replace this string with XZXYYZZ"

0 Karma
1 Solution

to4kawa
Ultra Champion
...
|rex mode=sed "s/(?<=server )\S+/XZXYYZZ/g"

View solution in original post

0 Karma

to4kawa
Ultra Champion
...
|rex mode=sed "s/(?<=server )\S+/XZXYYZZ/g"
0 Karma

marisstella
Explorer

I think, we're almost close to resolution..... Let's we have different type of error messages like this, so in every message we want replace one string like CorrelationID, hostname... so how can you replace the string on different error messages and combine as a single field. So that I can use this field anywhere in the dashboard or report?

0 Karma

to4kawa
Ultra Champion

correlationID?Hostname?
I don't know.

0 Karma

marisstella
Explorer

No no....I have already replaced majority of the strings based on your regex or idea.
Let's say, I have already wrote regex and able to replace.... Then how do I apply all the replaced strings with single fields...

0 Karma

to4kawa
Ultra Champion

all the replaced strings with single fields.
I don't know what these are.

...
 | rex "(?<=server )(?<anyfields>\S+)"
 | eventstats values(anyfields) as anyfields
 | eval single=mvjoin(anyfields,":")

?

0 Karma

marisstella
Explorer

I'm sorry, I'm just confused. How can I apply these changes on _raw data?
When I use the field as | eval _raw=error from server ABCD1234 under lp sy stem.. | rex mode=sed field=error_message "s/(?i)server\s+(\S+)/server xxx-yyy/g"
This is done to _raw, but din't see any changes in the raw data., The Idea is we need to remove the duplicate errors triggering...

0 Karma

to4kawa
Ultra Champion

my answer changes _raw.
If rex option field= is not set, this works to _raw.
your query has field=error_message.

0 Karma

marisstella
Explorer

Ohh, thanks!!! It will be very useful for L2 team...

0 Karma

adamsaul
Communicator

Here is the search string I used to test. Please note that field=orig_field will need to be adjusted to whatever the field name is in question, can even be _raw

| makeresults | eval orig_field="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
| rex mode=sed field=orig_field "s/(?i)server\s+(\S+)\s+under/XZXYYZZ/g"

0 Karma

marisstella
Explorer

Thanks for quick response, it is working fine... But I have around 300 different error messages, for all of then I want to replace a string it may be correlationID, Hostname,etc... Using your query, I will replace the string but the field name should be the same for all of 300 messages. How can I achieve this?

0 Karma

marisstella
Explorer

| makeresults | eval origin="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
|append[makeresults|eval origin="error occurred from the server SDFDKJ54121XV under lenderprice hop"]| rex mode=sed field=origin "s/(?i)server\s+(\S+)\s+under/server xxx-yyy under/g"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...