Splunk Search
Highlighted

How to replace a dynamic string in an event?

Explorer

I want to replace a dynamic string in an event..
Example: error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop...

Here "ABCXYZ12345ABCXYZ" is dynamic field. So i want to replace this string with XZXYYZZ"

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Communicator

Here is the search string I used to test. Please note that field=orig_field will need to be adjusted to whatever the field name is in question, can even be _raw

| makeresults | eval orig_field="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
| rex mode=sed field=orig_field "s/(?i)server\s+(\S+)\s+under/XZXYYZZ/g"

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Explorer

Thanks for quick response, it is working fine... But I have around 300 different error messages, for all of then I want to replace a string it may be correlationID, Hostname,etc... Using your query, I will replace the string but the field name should be the same for all of 300 messages. How can I achieve this?

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Explorer

| makeresults | eval origin="error occurred from the server ABCXYZ12345ABCXYZ under lenderprice hop"
|append[makeresults|eval origin="error occurred from the server SDFDKJ54121XV under lenderprice hop"]| rex mode=sed field=origin "s/(?i)server\s+(\S+)\s+under/server xxx-yyy under/g"

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Ultra Champion
...
|rex mode=sed "s/(?<=server )\S+/XZXYYZZ/g"

View solution in original post

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Explorer

I think, we're almost close to resolution..... Let's we have different type of error messages like this, so in every message we want replace one string like CorrelationID, hostname... so how can you replace the string on different error messages and combine as a single field. So that I can use this field anywhere in the dashboard or report?

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Ultra Champion

correlationID?Hostname?
I don't know.

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Explorer

No no....I have already replaced majority of the strings based on your regex or idea.
Let's say, I have already wrote regex and able to replace.... Then how do I apply all the replaced strings with single fields...

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Ultra Champion

all the replaced strings with single fields.
I don't know what these are.

...
 | rex "(?<=server )(?<anyfields>\S+)"
 | eventstats values(anyfields) as anyfields
 | eval single=mvjoin(anyfields,":")

?

0 Karma
Highlighted

Re: How to replace a dynamic string in an event?

Explorer

I'm sorry, I'm just confused. How can I apply these changes on raw data?
When I use the field as | eval _raw=error from server ABCD1234 under lp sy stem.. | rex mode=sed field=error
message "s/(?i)server\s+(\S+)/server xxx-yyy/g"
This is done to _raw, but din't see any changes in the raw data., The Idea is we need to remove the duplicate errors triggering...

0 Karma