Splunk Search

help to make regex

ckals46
New Member

hello all!

I have a sentense of raw data so I want to extract only one field.

raw data's example :

A,B,C,D,E,F,1234567891011,G,H,I,J,1234567891011,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,1234567891011,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,1234567891011,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,1234567891011,K,L,M,N

after example :

A,B,C,D,E,F,1234567891011,G,H,I,J,*,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,*,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,*,K,L,M,N
A,B,C,D,E,F,1234567891011,G,H,I,J,*,K,L,M,N

I want to change 12th field into a '*'

Please help me. Give me make it 😐

0 Karma

somesoni2
Revered Legend

You can try like this

| gentimes start=-1 | eval temp="A,B,C,D,E,F,1234567891011,G,H,I,J,1234567891011,K,L,M,N" | table temp | rename temp as _raw | rex mode=sed "s/^(([^,]*,){11})([^,]*)/\1*/"
0 Karma
Get Updates on the Splunk Community!

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...