Splunk regex help

[pjtbasu]

Hi Team,

I've a field name uri, which has value like this --

/dev/{AccountNumber}/accountDetail

/uat/{ContentID}/content

I want to extract one column like, 'uriwithregex' so that I can use it later. The value of uriwithregex will be like 

/dev/*/accountDetail

/uat/*/content

So basically want to replace the string with * (Including the curly brackets)

Could someone please help ?

[renjith_nair · Accepted solution]

Try

|makeresults|eval urls="/dev/{AccountNumber}/accountDetail /uat/{ContentID}/content"
|makemv urls| mvexpand urls
|eval uriwithregex=urls
|rex field=uriwithregex mode=sed "s/\{.+\}/*/g"

[pjtbasu]

Works fine. Thanks for the help