replacing parts inside string

[exocore123]

I had a field of this value

nameSpaces = ["url1"] 
nameSpaces = ["url1", "url2"]

I got rex to change ["url1", "url2"] into "url1, url2"
However, I am trying to change url1 to a label1, and url2 to label2, is there a way I can change it so the outcome from
"url1, url2" to "label1, label2"

[somesoni2 · Accepted solution]

Try like this

your current search giving field nameSpaces
| rex field=nameSpaces mode=sed "s/url/label/g"

[exocore123]

Perfect! what about if I had url1 and url3, and they're both the same, can I somehow condense it to rex field=nameSpaces mode=sed "s/url1 | url3/label/g" as well as multiple fields?

[somesoni2]

You could do like this

...| rex field=nameSpaces mode=sed "s/(ur1|url3)/label/g"

[exocore123]

Thanks! What about field=nameSpaces|nameSpaces2 mode=sed "s/(ur1|url3)/label/g"? Something similar? I tried that and did not work

[somesoni2]

You can't specify multiple fields in field attribute of rex command. You can either run rex multiple time for each nameSpace field, or use foreach command like this

... | foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]

[exocore123]

well technically my nameSpaces are two different fields (name wise), so I guess I am going to have to make duplicate rex lines then, maybe possibly rename?

[somesoni2]

I accidentally added a space after nameSpace in above foreach command. I'm using * as wildcard so any field which starts with nameSpace will get that replacement.

And yes, other option would be to add multiple rex commands for each nameSpaceN field.

[exocore123]

I got an "Unencoded <" error when using foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]

[somesoni2]

Are you trying to run it from dashboard?

[exocore123]

Yeah, in my query on dashboard

[somesoni2]

Guessing you're updating the dashboard xml directly, use the foreach like this

...|  foreach nameSpaces* [rex field="<<FIELD>>" mode=sed "s/(url1|url3)/label/g" ]

[exocore123]

I saw I can use rex sed mode, but I am a bit confused on mapping the string. Originally I used spath and then replace for the labels, but I noticed they showed up as single records, and messed up the total count for the logs, so I am trying to maintain the proper length of the array. I was thinking rex mode=sed "s/url1/label1"