Splunk Search

How do I edit my rex mode=sed syntax to replace part of my sample URIs with static text?

xvxt006
Contributor

Hi,

I have URIs like this:

/appliance/detail/v3.0/vendor/3423434erts/fridge
/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small

I want to replace the number part of the URI (3423434erts or 6757dfs32) with XXX (static text) and keep rest of the URI intact.
I tried this below and looks like some syntax error. Can someone help with this?

| rex field=uri mode=sed "s/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/(/appliance/detail/v3.0/vendor/[^/]+/(.*)$)/XXX/g" | table uri
0 Karma

jhollfelder_spl
Splunk Employee
Splunk Employee

In order to replace a portion of a field (or _raw), you need to use capture groups in your rex sed replacement command. The syntax for including the capture group in the sed replacement is to use a backslash and then the number of the capture group (starting with 1).

In the example below, I created two capture groups to get the first part of the URI and the back part after the product ID. I then structured the sed replacement to print out the first part (\1) followed by "XXX" (the static part you want to mask) followed by the second capture group (\2). Hope this helps! 😃

| makeresults
| eval uri="/appliance/detail/v3.0/vendor/3423434erts/fridge"
| rex field=uri mode=sed "s/^(\S+vendor\/)\w+(\S+)/\1XXX\2/g"

alt text

xvxt006
Contributor

Thank you all. I will try these and mark whatever works.

0 Karma

chimell
Motivator

HI xvxt006
Try this

| rex field=uri mode=sed "s/(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)|(\/appliance\/detail\/v3\.0\/vendor\/[^/]+\/(.)$)/XXX/g" | table uri
0 Karma

javiergn
SplunkTrust
SplunkTrust

Another approach using replace:

| stats count
| eval uri = "/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small"
| eval uri = replace(uri, "((?:\/[^\/]+){4}\/)[^\/]+(\/.+)", "\1XXX\2")

Jeremiah
Motivator

How about this? The result should be "/appliance/detail/v3.0/vendor/XXX/fridge".

| gentimes start=-1 | eval uri="/appliance/detail/v3.0/vendor/6757dfs32/refrigerator/small" | rex mode=sed field=uri "s/(.*\/vendor\/)[^\/]+(\/.*)/\1XXX\2/" | table uri
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...