Splunk Search

replacing and output

leomedina
Explorer

Hello all,

I have the following search:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<responseCode>.{4})"
| stats count by  responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

However, the | rex field=responseCode mode=sed "s/200/Success/g" is not working. I have also tried | replace "200" with "Success" and nothing... What am I doing wrong?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

View solution in original post

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

cpetterborg
SplunkTrust
SplunkTrust

Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode

The format of you CSV should be something like:

code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...