×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
singlinet
Engager
Member since: ‎11-24-2022
‎11-25-2022
Community Statistics
Posts 2
Solutions 1
Karma Given 0
Karma Received 1
Member Since ‎11-24-2022
Activity Feed
View All

Re: Using SED to remove optional fields

by in Splunk Search
‎11-24-2022 05:13 PM
1 Karma
‎11-24-2022 05:13 PM
1 Karma
Thanks for the suggestion. I have resolved the issue by defining  the full string as field Endpoint and then doing multiple passes to strip the various numeric identifiers. rex field=Endpoint mode=sed "s/(.*)(\/|$)\d{2,}$/\1\2<id>/g" | rex field=Endpoint mode=sed "s/(.*)(\/)\d{2,}(\/.*$)/\1\2<id>\3/g" | stats count by Endpoint ... View more

How to use SED to remove optional fields?

by in Splunk Search
‎11-24-2022 03:27 AM
‎11-24-2022 03:27 AM
We have api requests that I want to create statistics by the request but to do this I need to remove variable identifiers and any parameters. For example, with the following requestpatterns POST /api-work-order/v1/work-orders/10611946/labours-reporting/2004131 HTTP/1.1 GET /api-work-order/v1/work-orders/10611946/labours-reporting HTTP/1.1 PUT /api-work-order/v1/work-orders/10611946 HTTP/1.1 GET /api-work-order/v1/work-orders HTTP/1.1 I need to replace the identifiers to extract: POST /api-work-order/v1/work-orders/{id}/labours-reporting/{id} GET /api-work-order/v1/work-orders/{id}/labours-reporting PUT /api-work-order/v1/work-orders/{id} GET /api-work-order/v1/work-orders    ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎11-25-2022 07:52 PM
Karma from
View All