Splunk Search

How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"?

0range
Communicator

Hello everyone.

I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 and so one.

For example, I need these transformations:
/bar/1233131/foo -> /bar/id/foo
/bar/12313 -> /bar/id
/foo/a2b-b2a/bar -> /foo/id/bar

How can I do it in Splunk?

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex field=text mode=sed "s/(\/.*?\/)([^\/]*)($|\/.*)/\1id\3/" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Is the ID you're looking to substitute always just two directories deep? Or can it be 3, 4, 5+ sub-directories deep?

0 Karma

0range
Communicator

In general, it can be at any level

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the ID can be at any level, how is it distinguished from the rest of the file path?

---
If this reply helps you, Karma would be appreciated.

0range
Communicator

It's numeric or alfa-numberic with special structure

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex field=text mode=sed "s/(\/.*?\/)([^\/]*)($|\/.*)/\1id\3/" | ...
---
If this reply helps you, Karma would be appreciated.

0range
Communicator
| rex field=operation mode=sed "s/([0-9a-z]+\-)+[0-9a-z]+/id/" 

Works fine:) thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...