Replacing a field value which is present in another field using rex sed command

[akil8295]

Hi All,

I am trying to replace values which are already fields present in another field using rex and mode = sed.

 Example I have two fields ID and error and both of them are Dynamic and Unique. Some ID's are found in the error field.

Now I would like to replace the different ID's in the error field with a common String.

| rex field=error mode=sed "s/ID/ My Id/g"

If I type in a regular expression  it replaces a few but it is not very accurate and  that is why  I want to make use of the field which is Id itself.

However it is not able to replace. Kindly assist on how to do the same. Thank you!

[gcusello]

Hi @akil8295,

did you explored the choice to use calculated fields or automatic lookups?

so id you have some ID values in the error field, you could create a calculated field like this:

| eval ID=if(match(error="%12345%","12345",ID)

in this way you can create an ID value using what you find in the rrror field.

If the are too many to manage with one or more evals, you can use an automatic lookup (https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Makeyourlookupautomatic).

Ciao.

Giuseppe