Splunk Search

replacing and output

leomedina
Explorer

Hello all,

I have the following search:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<responseCode>.{4})"
| stats count by  responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

However, the | rex field=responseCode mode=sed "s/200/Success/g" is not working. I have also tried | replace "200" with "Success" and nothing... What am I doing wrong?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

View solution in original post

woodcock
Esteemed Legend

The problem is that you are capturing 4 any characters with .{4} and then you are comparing to 200 which is only 3 characters long. These must match or be otherwise compatible. Try this:

 index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code\D*(?<responseCode>\d+)"
| stats count BY responseCode 
| rex field=responseCode mode=sed "s/200/Success/g"

cpetterborg
SplunkTrust
SplunkTrust

Instead of doing the rex, use a lookup which would be more in line with what you probably want anyway if you want more than 200's replaced. You will have to install a CSV file of the codes with their long name responseCode, then use your search doing something like:

index =datapower environment=PROD mpgw(Subscription-Aysnc) 'HTTP response code*'
| rex field=_raw  "HTTP response code?(?<code>.{4})"
| lookup httpcodes code OUTPUT responseCode
| stats count by responseCode

The format of you CSV should be something like:

code,responseCode,info
100,Continue,Informational
101,Switching Protocols,Informational
200,OK,Successful
201,Created,Successful
202,Accepted,Successful
203,Non-Authoritative Information,Successful
204,No Content,Successful
205,Reset Content,Successful
206,Partial Content,Successful
300,Multiple Choices,Redirection
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...