Splunk Search

How to use regex to replace string?

knalla
Path Finder

Hi,

I have the below urls. How can I use the regex to remove the tokens from urls? Looking to remove data between /interactions/ and result_data.

sample:
https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data

output needed:

https://test.com:443/test11/interactions/result_data

Tags (2)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... rex field=url mode=sed "s%/interactions/.*/result_data%/interactions/result_data%"

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Are you looking to replace this as search time?

rex field=url "^(?<part1>.*/interactions)/.*/(?<part2>result_data)$" | eval url=part1."/".part2

If you are looking to do this at index time, you will need to use SEDCMD or transforms to replace the token (https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Anonymizedata ).
In props.conf,

SEDCMD-remove_tokens = s/interactions\/.*\/result-data/interactions\/result-data
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...