topic Re: How can I skip the first two "\n" letters from my fields? in Splunk Search

How can I skip the first two "\n" letters from my fields?

danielgp89 — Mon, 13 Nov 2017 18:42:15 GMT

Hello Everyone!

I want to remove the first two letters from my fields "\n" how can I do it?

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

I only want this:

CDIARIA2
CDIARIAC
MAROV91
MAFTB87
MATBU90

Regards!

Re: How can I skip the first two "\n" letters from my fields?

MuS — Mon, 13 Nov 2017 18:46:32 GMT

Can you provide more details around how you get these fields, please?

Re: How can I skip the first two "\n" letters from my fields?

danielgp89 — Mon, 13 Nov 2017 19:06:43 GMT

Hello MuS! Thanks for your answer.

This is the query I'm using

index=mf JCL ERROR* |stats count by jobname

An it brings me this but I don't want the \n

jobname count

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

Re: How can I skip the first two "\n" letters from my fields?

oawelewa — Mon, 13 Nov 2017 19:11:05 GMT

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

Re: How can I skip the first two "\n" letters from my fields?

somesoni2 — Mon, 13 Nov 2017 19:12:02 GMT

Try like this (run anywhere sample search, just add the last eval line to your existing search)

| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname 
| eval jobname=replace(jobname,"\\\n","")

Re: How can I skip the first two "\n" letters from my fields?

akocak — Mon, 13 Nov 2017 19:13:22 GMT

My answer would be same as somesoni

    eval jobname=replace(jobname,"\\\n","")

Re: How can I skip the first two "\n" letters from my fields?

MuS — Mon, 13 Nov 2017 19:19:12 GMT

Okay too slow in the morning hours 😉

here is my answer anyway:

| makeresults
| eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" 
| makemv foo 
| mvexpand foo
| eval jobname=ltrim(foo,"\n") 
| stats count by jobname

The first 4 lines are just to produce dummy data, the ltrim() is the one you can use to remove unwanted characters from the left.

cheers, MuS

Re: How can I skip the first two "\n" letters from my fields?

danielgp89 — Mon, 13 Nov 2017 19:31:01 GMT

Thanks so much!

It works!

Best Regards!

Re: How can I skip the first two "\n" letters from my fields?

danielgp89 — Mon, 13 Nov 2017 19:31:22 GMT

Thanks so much!

Best Regards!

Re: How can I skip the first two "\n" letters from my fields?

somesoni2 — Mon, 13 Nov 2017 19:37:34 GMT

This is neater than mine. +1

Re: How can I skip the first two "\n" letters from my fields?

niketn — Mon, 13 Nov 2017 20:12:15 GMT

@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.

<BaseSearch>
 | stats count by jobname
 | eval jobname=ltrim(foo,"\n")

Re: How can I skip the first two "\n" letters from my fields?

MuS — Mon, 13 Nov 2017 20:21:14 GMT

Here we go: three Fezzes make up a perfect answer 😉