Splunk Search

replace string in field value using eval or sed

Sri401
New Member

I have one field(query) value like

select * from host where id = 'something' and name = 'xxxxxx'

Now I want to replace id and name with '?'

I have tried with rex and sed something like
rex field=query mode=sed "s/name*./?/g" and also using eval filed=replace....

but i didn't find the solution

can any one please help me with this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex is incorrect. It's looking for "nam" followed by any number of "e"s followed by any character. Try this:

| rex field=query mode=sed "s/name/?/g" | rex field=query mode=sed "s/id/?/g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Sri401
New Member

thanks for your response,

I want to replace name and id value with ?. after replace string the output looks like

select * from host where id = '?' and name = '?'

name and id values are dynamic

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's different, but similar.

| rex field=query mode=sed "s/(name\s*=\s*')[^']+/\1/g" | rex field=query mode=sed "s/(id\s*=\s*')[^']+/\1/g"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...