Splunk Search

Regexes and the replace function

cphair
Builder

Hello,

I'm wondering if there's a way to trim characters from an unknown field value during search. I'm tracking perfmon data with Splunk, and when there are multiple instances of a process, they come in as iexplore#1, iexplore#2, etc. For my particular search, I want to strip any trailing #(number) from the field values and track the combined information about the instances. The replace function should be what I want, but variations on 'replace "^(\w*)#." with $1"' that I've tried don't seem to work. If I knew the process name in advance I could do 'replace "iexplore#" with iexplore', but I don't. Is there a way to do this?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You could use rex with a SEDCMD, similar to this:

... | rex mode=sed field=process_name "s/#\d+//"

Which is quite similar to what you already have, so I may be barking up the wrong tree...

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You could use rex with a SEDCMD, similar to this:

... | rex mode=sed field=process_name "s/#\d+//"

Which is quite similar to what you already have, so I may be barking up the wrong tree...

cphair
Builder

@aapittts: The part between the first and second slash is the pattern to match, and between the second and third slash is the replacement string. In this case it's empty because I wanted to get rid of the text entirely, but you could have something like field=process_name "s/foo/bar/" which would replace all occurences of foo in process_name with bar.

aapittts
Path Finder

what part of the regex in this example is the replacement string? I need to do something very similar.

0 Karma

cphair
Builder

That's the syntax I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...