Hi Team,
I have requirement, where I need to replace a series of numbers with something like this a/b/c/123456
with a/b/c{Id}
.
When I use regex and use \d
its replacing each and every decimal number with {Id}
something like this a/b/c/{Id}{Id}{Id}{Id}{Id}{Id}
.
I want something like a/b/c{Id}
, can you let me know how this can be achieved.
Like this:
|makeresults | eval raw="a/b/c/464646/d/e/242442424"
| rename COMMENT AS "Everything above fakes your data; everything below is your solution"
| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"
Replace ...
with as many additional iterations as you need of the sed
command string.
Like this:
|makeresults | eval raw="a/b/c/464646/d/e/242442424"
| rename COMMENT AS "Everything above fakes your data; everything below is your solution"
| rex field=raw mode=sed "s%/\d+/%/536RTYWW876Y788U998/% ... s%/\d+/%/536RTYWW876Y788U998/%"
Replace ...
with as many additional iterations as you need of the sed
command string.
Thanks this is super helpful, I am able to reduce my spunk query to lot better state.
One last question how this can be achived in case of Alpha Numeric.
I tried something like this.
|rex field=Path mode=sed "s/\w+\d+/{Id}/"
It didn't, help me, please let me know, if I am doing anything wrong here
So you are saying that your {Id}
strings do contain numbers/digits? If so, is it really surrounded by the literal curly-brace characters {
and }
(that will make the modified solution easier)?
actually my string won't contain any curly braces, it looks like this.
536RTYWW876Y788U998
OK, I updated my answer to accommodate your replacement strings; try it now.
Like this:
|makeresults | eval raw="a/b/c/1234567"
| rename COMMENT AS "Everything above fakes your data; everything below is your solution"
| rex field=raw mode=sed "s%a/b/c/\\d+%a/b/c/{ld}%"
Try like this
your base search | rex mode=sed field=yourfield "s/(\d+)/{Id}/"
OR
your base search | eval yourfield=replace(yourfield,"(\d+)","{Id}")
Thanks, this works, can you please let me know, if we need to replace all such formats like below.
a/b/c/464646/d/e/242442424
I want output like this
a/b/c/{Id1}/d/e/{Id2}
You really should be clear from the get-go. This is a very different request.