Splunk Search

How to search for part of a string matching a certain regex for an ID in a text field and replace it with "id"?

0range
Communicator

Hello everyone.

I need to substitute text "id" in text fields where I have ids now: like 123123123, 312asda-adas2 and so one.

For example, I need these transformations:
/bar/1233131/foo -> /bar/id/foo
/bar/12313 -> /bar/id
/foo/a2b-b2a/bar -> /foo/id/bar

How can I do it in Splunk?

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex field=text mode=sed "s/(\/.*?\/)([^\/]*)($|\/.*)/\1id\3/" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Is the ID you're looking to substitute always just two directories deep? Or can it be 3, 4, 5+ sub-directories deep?

0 Karma

0range
Communicator

In general, it can be at any level

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the ID can be at any level, how is it distinguished from the rest of the file path?

---
If this reply helps you, Karma would be appreciated.

0range
Communicator

It's numeric or alfa-numberic with special structure

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | rex field=text mode=sed "s/(\/.*?\/)([^\/]*)($|\/.*)/\1id\3/" | ...
---
If this reply helps you, Karma would be appreciated.

0range
Communicator
| rex field=operation mode=sed "s/([0-9a-z]+\-)+[0-9a-z]+/id/" 

Works fine:) thank you!

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...