Splunk Search

How to use regex to replace string?

knalla
Path Finder

Hi,

I have the below urls. How can I use the regex to remove the tokens from urls? Looking to remove data between /interactions/ and result_data.

sample:
https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data

output needed:

https://test.com:443/test11/interactions/result_data

Tags (2)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... rex field=url mode=sed "s%/interactions/.*/result_data%/interactions/result_data%"

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Are you looking to replace this as search time?

rex field=url "^(?<part1>.*/interactions)/.*/(?<part2>result_data)$" | eval url=part1."/".part2

If you are looking to do this at index time, you will need to use SEDCMD or transforms to replace the token (https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Anonymizedata ).
In props.conf,

SEDCMD-remove_tokens = s/interactions\/.*\/result-data/interactions\/result-data
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...