Splunk Search

How to replace digits in regex?

Dharani
Explorer

Hi,

Below is the example for raw log:

20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cust HTTP/1.1#0115ocilpapgap11.op.okobank.com

20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/cust/apis/info/015-000234567 HTTP/1.1#0115dummyvalue.com

20220906T23:43:58+03:00#0115dummyvalue.com#01110.111.169.11:51868#01110.45.38.135:8111#0110.527#011-#011-#011200#011200#0117180#011603#011GET /wapi/v3/gat/015-0000004847/cust/api HTTP/1.1#0115dummy value.com

 

From the above raw logs I need to extract the below fields:

/wapi/v3/gat/cust

/wapi/v3/gat/cust/apis/info/015-000234567

wapi/v3/gat/015-0000004847/cust/api

 

and it should be extracted and displayed in table/statistics like below format:

/wmpapi/v3/gat/cust

/wapi/v3/gat/cust/apis/info/{Id}

wapi/v3/gat/{Id}/cust/api

 

Basically in the fields , it should only take alphapets (including that v3) and we should replace digits to {Id} whereever it exist .

 

Can someone help me on this.

Thanks!

 

 

 

Labels (4)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex \S+\s(?<URL>\S+)\s
| rex field=URL mode=sed "s/\/[\d\-]+/\/{Id}/g"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex \S+\s(?<URL>\S+)\s
| rex field=URL mode=sed "s/\/[\d\-]+/\/{Id}/g"

Dharani
Explorer

Thank you this worked

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...