Splunk Search

replacing and output

leomedina
Explorer

Hello all,

I have the following search:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<responseCode>.{4})"
| stats count by  responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

However, the | rex field=responseCode mode=sed "s/200/Success/g" is not working. I have also tried | replace "200" with "Success" and nothing... What am I doing wrong?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

View solution in original post

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

cpetterborg
SplunkTrust
SplunkTrust

Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode

The format of you CSV should be something like:

code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...