Splunk Search

How to replace all "confusable" characters in field in data model?

jasmartin
Explorer

Hello, I am attempting to replace a large unwieldy macro with a data model. Part of the macro is a rex command that finds what we call "confusable characters" that are the highbit versions of ASCII characters, like 𝟐 or ꓜ, and replaces them with the ASCII versions (2 or Z respectively), like this:

rex field=$arg1$ mode=sed "y/𝟐𝟚𝟤𝟮𝟸ꝚƧϨꙄᒿꛯ/22222222222/"

The actual macro is much longer and encompasses all numbers and letters.

I have been having difficultly figuring out how to incorporate this into the data model. I've been able to use a CSV lookup like this:

char_search,old_char,new_char
*𝟐*,𝟐,2
*ꓜ*,ꓜ,Z

Make char_search a wildcard match field, and use this query:

| makeresults
| eval t="dfasdf𝟐𝟐"
| lookup CSVconfusables char_search as t OUTPUT
| eval u=replace(t,old_char,new_char)

It works find with 1 character to replace, but when there are multiple to replace, the lookup output fields become multivalue and replace doesn't work:

| makeresults
| eval t="ꓜdfasdf𝟐𝟐"
| lookup CSVconfusables char_search as t OUTPUT
| eval u=replace(t,old_char,new_char)

Is there any way to accomplish what the macro is doing in a data model? Thanks in advance!

Labels (3)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

@richgalloway's idea was close. If I understand you well, you need something like

 

| eval arg1=replace(arg1,"[𝟐𝟚𝟤𝟮𝟸ꝚƧϨꙄᒿꛯ]","2")

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Since the replace function uses regular expressions as does rex, have you tried putting the expressions from the macro into the DM?

| eval arg1=replace(arg1,"𝟐𝟚𝟤𝟮𝟸ꝚƧϨꙄᒿꛯ","22222222222")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

jasmartin
Explorer

Hi richgalloway , unfortunately that doesn't do what I need it to do. replace searches for the whole given string to replace. I want to do what sed does with "y/", where it's a one-on-one replacement.

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

@richgalloway's idea was close. If I understand you well, you need something like

 

| eval arg1=replace(arg1,"[𝟐𝟚𝟤𝟮𝟸ꝚƧϨꙄᒿꛯ]","2")

 

jasmartin
Explorer

That will work, thank you!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...