topic Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length in Splunk Search

i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

DataOrg — Fri, 09 Jun 2017 10:24:50 GMT

this is word obj:1-324dfs32 hello world obj:1-3453221 as a god

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

Richfez — Fri, 09 Jun 2017 12:15:13 GMT

Using "obj:1-324dfs32 hello world obj:1-3453221 as a god"

| rex mode=sed "s/obj\S+//g"

Should trim it to "hello world as a god"

The formatting of your example could be better, but that's probably the key thing above. It says to 's' substitute, whenever you find '/obj\S+' or the string "obj" followed by non-spaces, instead insert the characters "nothing" (there's nothing between the two // slashes for the substitution, globally /g (do it multiple times in one string, don't just do it the first time it sees it and stops).

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

DataOrg — Fri, 09 Jun 2017 12:55:23 GMT

it worked but it is timing other fields. i want it to cut with length only obj:1-3453221

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

DataOrg — Fri, 09 Jun 2017 12:58:19 GMT

otherwise we can cut with first space as space delimiter

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

Richfez — Fri, 09 Jun 2017 13:00:52 GMT

Sure, so you want to trim just that many characters -

| rex mode=sed "s/obj.{10}//g"

That says to find the string "obj" followed by precisely {10} of any character (. ) Obviously change the 10 to whatever you need, but I think it's about right.

If that's not quite right, can you provide a few more examples and exactly what you need each example to have as its output?

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

Richfez — Fri, 09 Jun 2017 13:49:25 GMT

My original answer does cut to the first space. Can you give more specifics about what it does wrong?

Re: i want to remove all the word starts with OBJ and till 1-3453221. the number will be dynamic and constant in length . we need to remove from string based on OBJ with length

DataOrg — Fri, 09 Jun 2017 13:49:53 GMT

thanks. it's worked. 🙂