Splunk Search

Replace random string in a field

pjtbasu
Explorer

Hi team,

I've 1 field named - 'URI' coming in micro service log dump.

Example Values of URI field is like below -

/mobile/login
/desktop/login
/account/100123445/details
/account/100123999/details
/public/account/XYZAASWDDSSSS/transactions
/public/account/XYZQWERTS/transactions

Now I'm just trying to see successful or failure transactions list sorted by the URI.

My example query -
index=mslogs "successful"|stats count by URI

Now the problem is, the result is coming as -
URI Count
/mobile/login 50
/desktop/login 50
/account/100123445/details 1
/account/100123999/details 1
/public/account/XYZAASWDDSSSS/transactions 1
/public/account/XYZQWERTS/transactions 1

Obviously, I need this to show like -

/mobile/login 50
/desktop/login 50
/account//details 2
/public/account/
/transactions 2

Basically I want to remove the random string part in the 'URI' field. Different URI has different random parts and those random parts are present differently in the URI. I'm willing to write regex to handle all the scenario in URI, but I want to replace them with '*' so that if I do a 'stats' or timechart, single URI.

Please suggest.

0 Karma

jacobpevans
Motivator

Greetings @pjtbasu,

As you said, you'll want to regex them out. The beginning of the regex replace command for all of them would be | eval URI = replace(URI,. followed by:

/account/#####/details = "(/account)/[^/]+(/details)", "\1\2")
/public/account/#####/transactions = "(/public/account)/[^/]+(/transactions)", "\1\2")

Here's a run-anywhere search for your sample data:

| makeresults
| eval URI="/account/100123445/details"
| append [ | makeresults | eval URI="/public/account/XYZAASWDDSSSS/transactions" ]
| eval URI = replace(URI, "(/account)/[^/]+(/details)",             "\1\2")
| eval URI = replace(URI, "(/public/account)/[^/]+(/transactions)", "\1\2")
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...