Splunk Search

Replace parts of a string

hbazan
Path Finder

Hi! I'm trying to replace parts of a string, in order to make it more human-readable. Our logs contains strings like this one:

<properties><property><key>Prop1</key><value>1</value></property><property><key>Prop2</key><value>3</value></property><property><key>Prop3</key><value>2</value></property></properties>

And I want to show it like:

Prop1 = 1 | Prop2 = 3 | Prop3 = 2

I've extracted the inner part using:

rex "\<properties>(?<Properties>.*)\</properties>" 

And for the values I've tried using replace, but it won't let me replace the inner part of the string. I'm trying with makemv, but I can't get what I want. Is this possible?

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You should be able to do this with rex's sed mode, similar to this:

| rex mode=sed "s#(<properties>)*<property><key>([^<]*)</key><value>([^<]*)</value></property>(</properties>)*#\2 = \3 #g"

This should also be usable as a "SEDCMD" in your props.conf file to edit the incoming data on the fly as it comes into splunk.

View solution in original post

sideview
SplunkTrust
SplunkTrust

One simple and low-tech way is to use eval's 'replace' function.

its not the prettiest but it might not make your head hurt as much as using rex in 'sed' mode. 😃

after your rex:

| rex "\<properties>(?<Properties>.*)\</properties>" |

put this:

| eval Properties=replace(Properties, "</key><value>", " = ") | eval Properties=replace(Properties, "</value></property><property><key>", " | ") | eval Properties=replace(Properties, "<property><key>", "") | eval Properties=replace(Properties, "</value></property>", "")

and while we're considering nutty solutions, here's another one. Again tack this onto the end of your rex where you're extracting the Properties string.

| eval Properties=replace(Properties, "<property>", "") | makemv Properties delim="</property>" | mvexpand Properties | rename Properties as _raw | xmlkv

that last one actually makes multivalued field and then splits them into their own rows... mileage/applicability may vary.

dwaddle
SplunkTrust
SplunkTrust

You should be able to do this with rex's sed mode, similar to this:

| rex mode=sed "s#(<properties>)*<property><key>([^<]*)</key><value>([^<]*)</value></property>(</properties>)*#\2 = \3 #g"

This should also be usable as a "SEDCMD" in your props.conf file to edit the incoming data on the fly as it comes into splunk.

hbazan
Path Finder

Great! thanks dwaddle, I owe you a beer!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...