<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Needs to trim the nos at last in column in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372074#M42995</link>
    <description>&lt;P&gt;Following is a run anywhere search using &lt;STRONG&gt;eval&lt;/STRONG&gt; with &lt;STRONG&gt;replace&lt;/STRONG&gt; and regular expression based matching group.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You can also do this with &lt;STRONG&gt;rex&lt;/STRONG&gt; and &lt;STRONG&gt;sed&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Wed, 10 May 2017 16:09:39 GMT</pubDate>
    <dc:creator>niketn</dc:creator>
    <dc:date>2017-05-10T16:09:39Z</dc:date>
    <item>
      <title>Needs to trim the nos at last in column</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372072#M42993</link>
      <description>&lt;P&gt;I have one column which has values like "abcd12","xy3","efg234". I want to trim no.s at the last and needs only string values. How can I do that.&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 15:39:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372072#M42993</guid>
      <dc:creator>uhkc777</dc:creator>
      <dc:date>2017-05-10T15:39:38Z</dc:date>
    </item>
    <item>
      <title>Re: Needs to trim the nos at last in column</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372073#M42994</link>
      <description>&lt;P&gt;try a regex to strip the values so that its picks only the string values [a-z]&lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 15:47:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372073#M42994</guid>
      <dc:creator>naidusadanala</dc:creator>
      <dc:date>2017-05-10T15:47:37Z</dc:date>
    </item>
    <item>
      <title>Re: Needs to trim the nos at last in column</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372074#M42995</link>
      <description>&lt;P&gt;Following is a run anywhere search using &lt;STRONG&gt;eval&lt;/STRONG&gt; with &lt;STRONG&gt;replace&lt;/STRONG&gt; and regular expression based matching group.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Or&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You can also do this with &lt;STRONG&gt;rex&lt;/STRONG&gt; and &lt;STRONG&gt;sed&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 10 May 2017 16:09:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372074#M42995</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2017-05-10T16:09:39Z</dc:date>
    </item>
    <item>
      <title>Re: Needs to trim the nos at last in column</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372075#M42996</link>
      <description>&lt;P&gt;This gets rid of numbers only when they are at the end...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval myfield="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield "(?&amp;lt;myfield&amp;gt;.*?[a-zA-Z])\d*$"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;...So does this...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval myfield2="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield2 mode=sed "s/[0-9]*$//g"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;... and this gets rid of all numbers everywhere...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval myfield3="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield3 mode=sed "s/[0-9]//g"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The first two lines of each group just make test data, the last does the work. &lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 16:20:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Needs-to-trim-the-nos-at-last-in-column/m-p/372075#M42996</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2017-05-10T16:20:24Z</dc:date>
    </item>
  </channel>
</rss>

