topic Re: How do you use regex to remove duplicate characters? in Splunk Search

How do you use regex to remove duplicate characters?

mistydennis — Thu, 28 Mar 2019 20:52:04 GMT

I have a report that requires several fields to be concatenated, each separated by a semicolon. Because some of the fields are null, the values look like this:

cat; dog; ; ; ; snake; bird; ; hamster; ; ;

I want the field to look like this:

cat; dog; snake; bird; hamster

Is there a way to use regex to remove the duplicate semicolons? I'd also like to make sure the field does not end with a semicolon.

Open to other ideas if regex is not the best solution.

Re: How do you use regex to remove duplicate characters?

vnravikumar — Thu, 28 Mar 2019 21:49:30 GMT

Try this

| makeresults 
| eval msg="cat; dog; ; ; ; snake; bird; ; hamster; ; ;" 
| makemv delim=";" msg 
| eval msg= ltrim(msg) 
| eval msg=mvjoin(mvfilter(msg!=""),";")

Re: How do you use regex to remove duplicate characters?

mistydennis — Fri, 29 Mar 2019 15:11:51 GMT

YES! Thank you so much!