Splunk Search

replacing and output

leomedina
Explorer

Hello all,

I have the following search:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<responseCode>.{4})"
| stats count by  responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

However, the | rex field=responseCode mode=sed "s/200/Success/g" is not working. I have also tried | replace "200" with "Success" and nothing... What am I doing wrong?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

View solution in original post

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

cpetterborg
SplunkTrust
SplunkTrust

Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode

The format of you CSV should be something like:

code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...