topic Re: How to remove everything after a specific character from a field in Getting Data In

How to remove everything after a specific character from a field

Shashank_87 — Mon, 20 Apr 2020 14:11:30 GMT

Hi I want to remove everything after a some characters like ? OR & when they come in a field. For example -

/temp/test?csrkyyt=12334

/test1/test2&csrkyyt=7968676

Can someone help?

Re: How to remove everything after a specific character from a field

gcusello — Mon, 20 Apr 2020 14:16:40 GMT

Hi @Shashank_87,
you can use the rex comman, something like this:

index=my_index
| rex field=my_field "^(?<my_field>[^\&\?]*)"
| ...

that you can test at https://regex101.com/r/f8lmIs/1 .

Ciao.
Giuseppe

Re: How to remove everything after a specific character from a field

manjunathmeti — Mon, 20 Apr 2020 14:24:39 GMT

You can use rex with sed to remove all characters after ? OR &.

| rex mode=sed field=FIELD_NAME "s/[&?].*//g"

Re: How to remove everything after a specific character from a field

vnravikumar — Tue, 21 Apr 2020 02:56:42 GMT

Hi @Shashank_87

Check this

| makeresults 
| eval text="/temp/test?csrkyyt=12334##/test1/test2&csrkyyt=7968676" 
| makemv delim="##" text 
| mvexpand text 
| rex field=text "(?P<output>^[^(?|&)]+)"