Splunk Search

sed to replace a string after a match

anoopdi
Path Finder

Is there a way I can substitute a string after a regular expression match? For example, i want to replace the IP address which appears after 'Chrome/'

70.31.171.12 - admin [24/Aug/2020:14:31:44.596 +0000] "GET /en-US/splunkd/__raw/services/search/shelper?output_mode=json&snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+sourcetype%3Dsplunkd_ui_access+&useTypeahead=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1598275250371 HTTP/1.1" 200 5620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36" - e02845bc5c07fae3e33855fca82cc968 12ms

I am able to use 'sed' to replace one more match of IP address but do not know how to replace a specific one.

I want the event to look like this after the running sed,

70.31.171.12 - admin [24/Aug/2020:14:31:44.596 +0000] "GET /en-US/splunkd/__raw/services/search/shelper?output_mode=json&snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+sourcetype%3Dsplunkd_ui_access+&useTypeahead=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1598275250371 HTTP/1.1" 200 5620 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/xxx.xxx.xxx.xxx Safari/537.36" - e02845bc5c07fae3e33855fca82cc968 12ms

0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

 

| rex field=_raw mode=sed "s#Chrome/(\d+\.\d+\.\d+\.\d+)#Chrome/xxxxxxx#"

 

Works with previous sample.

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

 

| rex field=_raw mode=sed "s#Chrome/(\d+\.\d+\.\d+\.\d+)#Chrome/xxxxxxx#"

 

Works with previous sample.

r. Ismo 

anoopdi
Path Finder

Awesome!!. Thank you so much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...