Splunk Search

How to rex using sed rex command?

Communicator

How to rex using sed rex command?

index = main
| rex field=URI "^(?.+?)(\?|\z)"
|rex field=New_APIName mode=sed "s/\d+[a-zA-Z0-9*]/XXXX/g"
| stats count by New_APIName

I am getting output as

/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX/benefitlist

/v1/cp/members/XXXX/benefits/XXXXBG-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXUF-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXUU-XXXX-XXXX-/excluded

/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/benefitlist

/v1/cp/members/XXXX/benefits/XXXXXXXX-XXXX-XXXX-/excluded

Expected result:

/v1/cp/members/XXXX/benefits/XXXX/benefitlist

/v1/cp/members/XXXX/benefits/XXXX/excluded

Tags (2)

SplunkTrust
SplunkTrust

Hi,

try this one

| rex mode=sed field=<yourfield> "s/^(\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\/)[^\/]*(\/[^\/]*)/\1XXXX\2/g"

https://regex101.com/r/rwjLxP/1

Super Champion

Hi @karthi2809
Try below regex:

 <base search> | rex mode=sed field=New_APIName "s/(^\/\w+\/\w+\/\w+\/\w+\/\w+\/.{4})[^\/]+(\/\w+)/\1\2/"
0 Karma

Explorer

Most likely you have a problem with the regular expression.

What are the actual values of XXXX (letters, numbers)?

The regular expression you have is looking for 1 or more digits followed by 0 or more letters or numbers and replacing the matches with XXXX

regex101.com is a good online regex utility to help build regular expressions

0 Karma