Splunk Search

How to use regex to replace string?

knalla
Path Finder

Hi,

I have the below urls. How can I use the regex to remove the tokens from urls? Looking to remove data between /interactions/ and result_data.

sample:
https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data

output needed:

https://test.com:443/test11/interactions/result_data

Tags (2)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... rex field=url mode=sed "s%/interactions/.*/result_data%/interactions/result_data%"

burwell
SplunkTrust
SplunkTrust

Similar to what sduff wrote but more generalized to just remove everything between the last slashes (/)

| rex field=url "(?<part1>.+\/).+\/(?<part2>.+)"
| eval url=part1+part2
0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Are you looking to replace this as search time?

rex field=url "^(?<part1>.*/interactions)/.*/(?<part2>result_data)$" | eval url=part1."/".part2

If you are looking to do this at index time, you will need to use SEDCMD or transforms to replace the token (https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Anonymizedata ).
In props.conf,

SEDCMD-remove_tokens = s/interactions\/.*\/result-data/interactions\/result-data
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...