Splunk Search

Using transforms and props to search and replace multiple fields in an event

Builder

If I have an event that looks like this:

META1 META2 {foo:bar,color:green,size:medium} some text ({client: x, ip: z})

And I want to use a single transforms to replace the values for foo, color and size, to produce logs like:

META1 META2 {foo:###,color:###,size:###} some text ({client:x, ip:z})

I wanted to use the following in transforms, but it's only replacing the first field:

REGEX=(?m)(META.* {)(foo|color|size):\w(}.*)$
FORMAT=$1###$3

It only masks the first value, how would I match multiple values?

Sample log output

    META1 META2 {foo:###,color:green,size:medium some text ({client:x, ip:z})
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Try adding REPEAT_MATCH = true to the transforms.conf stanza.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Builder

thanks @richgalloway , am testing this now.

0 Karma

SplunkTrust
SplunkTrust

Still testing? If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

@brettcave,

Legend has it that @richgalloway is still looking for that upvote.

0 Karma

Builder

accepted answer.

0 Karma