Splunk Search

Regexes and the replace function

cphair
Builder

Hello,

I'm wondering if there's a way to trim characters from an unknown field value during search. I'm tracking perfmon data with Splunk, and when there are multiple instances of a process, they come in as iexplore#1, iexplore#2, etc. For my particular search, I want to strip any trailing #(number) from the field values and track the combined information about the instances. The replace function should be what I want, but variations on 'replace "^(\w*)#." with $1"' that I've tried don't seem to work. If I knew the process name in advance I could do 'replace "iexplore#" with iexplore', but I don't. Is there a way to do this?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You could use rex with a SEDCMD, similar to this:

... | rex mode=sed field=process_name "s/#\d+//"

Which is quite similar to what you already have, so I may be barking up the wrong tree...

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You could use rex with a SEDCMD, similar to this:

... | rex mode=sed field=process_name "s/#\d+//"

Which is quite similar to what you already have, so I may be barking up the wrong tree...

cphair
Builder

@aapittts: The part between the first and second slash is the pattern to match, and between the second and third slash is the replacement string. In this case it's empty because I wanted to get rid of the text entirely, but you could have something like field=process_name "s/foo/bar/" which would replace all occurences of foo in process_name with bar.

aapittts
Path Finder

what part of the regex in this example is the replacement string? I need to do something very similar.

0 Karma

cphair
Builder

That's the syntax I was looking for. Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...