Splunk Search

Replace random string in a field


Hi team,

I've 1 field named - 'URI' coming in micro service log dump.

Example Values of URI field is like below -


Now I'm just trying to see successful or failure transactions list sorted by the URI.

My example query -
index=mslogs "successful"|stats count by URI

Now the problem is, the result is coming as -
URI Count
/mobile/login 50
/desktop/login 50
/account/100123445/details 1
/account/100123999/details 1
/public/account/XYZAASWDDSSSS/transactions 1
/public/account/XYZQWERTS/transactions 1

Obviously, I need this to show like -

/mobile/login 50
/desktop/login 50
/account//details 2
/transactions 2

Basically I want to remove the random string part in the 'URI' field. Different URI has different random parts and those random parts are present differently in the URI. I'm willing to write regex to handle all the scenario in URI, but I want to replace them with '*' so that if I do a 'stats' or timechart, single URI.

Please suggest.

0 Karma


Greetings @pjtbasu,

As you said, you'll want to regex them out. The beginning of the regex replace command for all of them would be | eval URI = replace(URI,. followed by:

/account/#####/details = "(/account)/[^/]+(/details)", "\1\2")
/public/account/#####/transactions = "(/public/account)/[^/]+(/transactions)", "\1\2")

Here's a run-anywhere search for your sample data:

| makeresults
| eval URI="/account/100123445/details"
| append [ | makeresults | eval URI="/public/account/XYZAASWDDSSSS/transactions" ]
| eval URI = replace(URI, "(/account)/[^/]+(/details)",             "\1\2")
| eval URI = replace(URI, "(/public/account)/[^/]+(/transactions)", "\1\2")

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...