Splunk Search

sed to replace a string after a match

anoopdi
Path Finder

Is there a way I can substitute a string after a regular expression match? For example, i want to replace the IP address which appears after 'Chrome/'

70.31.171.12 - admin [24/Aug/2020:14:31:44.596 +0000] "GET /en-US/splunkd/__raw/services/search/shelper?output_mode=json&snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+sourcetype%3Dsplunkd_ui_access+&useTypeahead=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1598275250371 HTTP/1.1" 200 5620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36" - e02845bc5c07fae3e33855fca82cc968 12ms

I am able to use 'sed' to replace one more match of IP address but do not know how to replace a specific one.

I want the event to look like this after the running sed,

70.31.171.12 - admin [24/Aug/2020:14:31:44.596 +0000] "GET /en-US/splunkd/__raw/services/search/shelper?output_mode=json&snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+sourcetype%3Dsplunkd_ui_access+&useTypeahead=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1598275250371 HTTP/1.1" 200 5620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/xxx.xxx.xxx.xxx Safari/537.36" - e02845bc5c07fae3e33855fca82cc968 12ms

0 Karma
1 Solution

soutamo
SplunkTrust
SplunkTrust

Hi

 

| rex field=_raw mode=sed "s#Chrome/(\d+\.\d+\.\d+\.\d+)#Chrome/xxxxxxx#"

 

Works with previous sample.

r. Ismo 

View solution in original post

soutamo
SplunkTrust
SplunkTrust

Hi

 

| rex field=_raw mode=sed "s#Chrome/(\d+\.\d+\.\d+\.\d+)#Chrome/xxxxxxx#"

 

Works with previous sample.

r. Ismo 

View solution in original post

anoopdi
Path Finder

Awesome!!. Thank you so much!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!