Splunk Search

How to edit my regex to replace a number 0-9?

smaran06
Path Finder

Hi Team,

I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456 with a/b/c{Id}.

When I use regex and use \d its replacing each and every decimal number with {Id} something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}.

I want something like a/b/c{Id}, can you let me know how this can be achieved.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/464646/d/e/242442424"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"

Replace ... with as many additional iterations as you need of the sed command string.

0 Karma

smaran06
Path Finder

Thanks this is super helpful, I am able to reduce my spunk query to lot better state.

One last question how this can be achived in case of Alpha Numeric.

I tried something like this.

|rex field=Path mode=sed "s/\w+\d+/{Id}/"

It didn't, help me, please let me know, if I am doing anything wrong here

0 Karma

woodcock
Esteemed Legend

So you are saying that your {Id} strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters { and } (that will make the modified solution easier)?

0 Karma

smaran06
Path Finder

actually my string won't contain any curly braces, it looks like this.

536RTYWW876Y788U998

0 Karma

woodcock
Esteemed Legend

OK, I updated my answer to accommodate your replacement strings; try it now.

0 Karma

woodcock
Esteemed Legend

Like this:

|makeresults | eval raw="a/b/c/1234567"

| rename COMMENT AS "Everything above fakes your data; everything below is your solution"

| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"

OR

your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")
0 Karma

smaran06
Path Finder

Thanks, this works, can you please let me know, if we need to replace all such formats like below.

a/b/c/464646/d/e/242442424

I want output like this

a/b/c/{Id1}/d/e/{Id2}

0 Karma

woodcock
Esteemed Legend

You really should be clear from the get-go. This is a very different request.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...