Splunk Search

Remove timestamps using regex

oliverpeloton23
Engager

Hi Splunk Community,

It's been a while since I've last used Splunk and regex, and now I'm struggling with both 🙂

Fields that I need to use ("resourceId") contain two user IDs and timestamps (e.g., "owner-10785-user-3801-key-1637099215"). I'm looking to keep the IDs and remove timestamps (basically everything after "owner-19803-user-8925-").

I came up with this clumsy thing:

index=main | eval resourceId1=replace (resourceId, "user-(?<user_id>\d+)", "") | eval resourceId2=replace (resourceId1, "owner-(?<owner_id>\d+)", "") | table resourceId2

It kind of works, the only problem is that it gives me the opposite result - it removes all the IDs leaving the timestamps, like this:

resourceId2
--key-1637100297
--1637100120.0929909
--key-1637100118

But I need the opposite. Can anyone please help?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=resourceId "owner-(?<owner>\d+)-user-(?<user>\d+)"
| eval resourceId2="owner-".owner."-user-".user

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=resourceId "owner-(?<owner>\d+)-user-(?<user>\d+)"
| eval resourceId2="owner-".owner."-user-".user

oliverpeloton23
Engager

Thank you!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...