Splunk Search

replace string in field value using eval or sed

Sri401
New Member

I have one field(query) value like

select * from host where id = 'something' and name = 'xxxxxx'

Now I want to replace id and name with '?'

I have tried with rex and sed something like
rex field=query mode=sed "s/name*./?/g" and also using eval filed=replace....

but i didn't find the solution

can any one please help me with this

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The regex is incorrect. It's looking for "nam" followed by any number of "e"s followed by any character. Try this:

| rex field=query mode=sed "s/name/?/g" | rex field=query mode=sed "s/id/?/g"
---
If this reply helps you, Karma would be appreciated.
0 Karma

Sri401
New Member

thanks for your response,

I want to replace name and id value with ?. after replace string the output looks like

select * from host where id = '?' and name = '?'

name and id values are dynamic

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's different, but similar.

| rex field=query mode=sed "s/(name\s*=\s*')[^']+/\1/g" | rex field=query mode=sed "s/(id\s*=\s*')[^']+/\1/g"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...