topic Re: How to remove the leading and trailing spaces of the indexedField? in Splunk Enterprise

How to remove the leading and trailing spaces of the indexedField?

Ashwini008 — Mon, 08 Feb 2021 06:55:04 GMT

i want to remove the spaces of the leading and trailing of my field.

I am trying to use trim and below Rex both are not working for me.

|eval NewField=trim(OldField)

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

My data

EX:(dots is to show the space)

TR#

CR1K901395........
BT1K901394
CT2K901398
KMK901397.........
NHK901393

|eval TRIM=trim(TR#) this is throwing me an error.

Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field?

Re: How to remove the leading and trailing spaces of the indexedField?

ITWhisperer — Mon, 08 Feb 2021 07:03:00 GMT

What is the error being thrown? Have you tried putting your field name in single quotes?

Re: How to remove the leading and trailing spaces of the indexedField?

Ashwini008 — Mon, 08 Feb 2021 07:18:49 GMT

@ITWhisperer i had missed the quotes but after adding single quotes also i dont see the expected result even though i am not getting any error.

| eval TR#=trim('TR#')

I exported my panel data to see if the spaces are removed but still it is present as shown below

Re: How to remove the leading and trailing spaces of the indexedField?

ITWhisperer — Mon, 08 Feb 2021 07:52:24 GMT

It looks like from the graphic that you may have some extended ASCII characters trailing your values - is it these that you want to remove? You could try something like this (again you may need single quotes around the field name)

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

Re: How to remove the leading and trailing spaces of the indexedField?

Ashwini008 — Mon, 08 Feb 2021 08:23:03 GMT

@ITWhisperer when i search my indexed data it looks like below shown

But when i export the same data from panel it looks like this

So i need to make sure when we export the data there are not such characters.

P.s the data indexed in splunk is from sharepoint portal where it is updated TR with trailing Spaces.

Re: How to remove the leading and trailing spaces of the indexedField?

ITWhisperer — Mon, 08 Feb 2021 08:45:38 GMT

Did you try the rex?

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

You may need to do the trim as well beforehand and/or remove the $ from the end of the match string

Re: How to remove the leading and trailing spaces of the indexedField?

Ashwini008 — Mon, 08 Feb 2021 09:44:07 GMT

@ITWhisperer Yes i tried but getting the below error.When i inspect no details found

The search job has failed due to an error. You may be able view the job in the job inspector.

Can we use trim function for the FIELD or is it specific to values of the field?

Re: How to remove the leading and trailing spaces of the indexedField?

ITWhisperer — Mon, 08 Feb 2021 09:58:04 GMT

Try this

| rex field=myField mode=sed "s/[\x80-\xff]*//g"

Re: How to remove the leading and trailing spaces of the indexedField?

Ashwini008 — Mon, 08 Feb 2021 10:36:15 GMT

I dont see error now,but the trailing space isnt removed and the ASCII character is stillpresent when exported.

| eval TR#=trim('TR#')
| rex field='TR#' mode=sed "s/[\x80-\xff]*//g"