Splunk Search

Replace entire string if it contains partial string

darls15
Explorer

Can anyone tell me how I would replace entire strings if they contain partial strings. As a basic example, in my search results, if a URL contains the word "homework", I would like to replace the entire URL with just "Homework", if it contains "learn", then "Learning" and so on. I have tried the search below a number of ways and can't seem to get it to work the way I need.

| eval domain = if(cs_host = "*homework*", "homework", if(cs_host = "*learn*", "learning",cs_host))

Domain            Count
Homework         2
Learning             5
etc

Thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@darls15,

Try

|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)

 

Sample result

|makeresults|eval domains="https://homework.mydomain.com https://learn.mydomain.com https://school.mydomain.com"|makemv domains|mvexpand domains
|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)
|stats count by category

alternatively you may use regex to extract the domains if there are multiple domains to be identified.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@darls15,

Try

|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)

 

Sample result

|makeresults|eval domains="https://homework.mydomain.com https://learn.mydomain.com https://school.mydomain.com"|makemv domains|mvexpand domains
|eval category=case(like(domains, "%homework%"),"HomeWork",like(domains, "%learn%"),"Learning",like(domains, "%school%"),"School",1==1,domains)
|stats count by category

alternatively you may use regex to extract the domains if there are multiple domains to be identified.

Happy Splunking!

darls15
Explorer

Thanks renjith_nair, just what I needed!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...