Splunk Search

How to use sed to replace a string with value from another variable?

pdahal
Engager

I want to replace scheduleendtime=...& with scheduleendtime=valueOf(difference) in Splunk output.

In Linux shell, this can be done using sed s/scheduleendtime=[^&]*/scheduleendtime=$difference/. When I try using same command in splunk, I fail horribly. Splunk doesn't do variable replacement in sed rather every occurrence of "scheduleendtime=[^&]*" is replaced with "scheduleendtime=$difference" exact string.

... | eval difference = case(schedule_time_diff <= 4200,"<_1_hour", schedule_time_diff < 28800, "<_8_hours", schedule_time_diff < 172800, " <_2_days") | rex mode=sed s/scheduleendtime=[^&]*/scheduleendtime=$difference/

I used sed because I am comfortable with it. If you think another command works better in this scenario, please let me know.

0 Karma
1 Solution

gokadroid
Motivator

Based on your comment above:
How can i insert that value in splunk output?

Here is how you can get the output back in raw and might not need sed at all:

... | eval difference = case(schedule_time_diff <= 4200,"<_1_hour", schedule_time_diff < 28800, "<_8_hours", schedule_time_diff < 172800, " <_2_days") 
| rex "^(?<headOfText>.*scheduleendtime=)[^&]*(?<tailOfText>\&.*)"
| eval _raw=headOfText.difference.tailOfText

View solution in original post

gokadroid
Motivator

Based on your comment above:
How can i insert that value in splunk output?

Here is how you can get the output back in raw and might not need sed at all:

... | eval difference = case(schedule_time_diff <= 4200,"<_1_hour", schedule_time_diff < 28800, "<_8_hours", schedule_time_diff < 172800, " <_2_days") 
| rex "^(?<headOfText>.*scheduleendtime=)[^&]*(?<tailOfText>\&.*)"
| eval _raw=headOfText.difference.tailOfText

pdahal
Engager

Thank you @gokadroid. This works like a charm.
BTW, you missed a quote at the end of 3rd line.

0 Karma

gokadroid
Motivator

damn...I need to go to get my eyes checked up.. thanks man...editing the rex piece. An upvote will help a lot too.

0 Karma

sundareshr
Legend

Why not just set scheduleendtimetodifferenceusingeval...eval scheduleendtime=difference`.?

0 Karma

pdahal
Engager

That would create a variable named scheduleendtime and it would hold value of difference.
How can i insert that value in splunk output?

0 Karma

sundareshr
Legend

How about replace() function. Here's a simple example on how you might be able to use it

| makeresults 
| eval searchtime="sometext&somemoretext" 
| eval difference="123456" 
| eval searchtime=replace(searchtime, "^([^&]+)", difference) 
| table searchtime difference
0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...