Splunk Search

replacing and output

leomedina
Explorer

Hello all,

I have the following search:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<responseCode>.{4})"
| stats count by  responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

However, the | rex field=responseCode mode=sed "s/200/Success/g" is not working. I have also tried | replace "200" with "Success" and nothing... What am I doing wrong?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

View solution in original post

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

cpetterborg
SplunkTrust
SplunkTrust

Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode

The format of you CSV should be something like:

code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...