topic Re: Use rex to remove leading zeros in Splunk Search

Use rex to remove leading zeros

bablucho — Fri, 04 Jan 2019 17:05:24 GMT

Regex:

Printed\s\s\s\s.(.+)

Test String:
Printed : 001727

Output:
1. 001727

I want the output to display without the leading zeros. so as it appears: 1727

Can anybody help?

Re: Use rex to remove leading zeros

wenthold — Fri, 04 Jan 2019 17:12:13 GMT

The rex string I'd use:

Printed[\s:]+[0]*(?<your_field>[0-9]+)

Re: Use rex to remove leading zeros

Vijeta — Fri, 04 Jan 2019 17:12:41 GMT

You can use ltrim function

|makeresults| eval x="001727"|eval x= ltrim(tostring(x),"0")

Re: Use rex to remove leading zeros

cpetterborg — Fri, 04 Jan 2019 17:13:40 GMT

Probably something like:

Printed\D+0*(\d+)

should work. \D+ is all non-digits, followed by zero or more 0's, then it puts the other digits is the capture group.

Re: Use rex to remove leading zeros

saurabhkharkar — Fri, 04 Jan 2019 17:23:30 GMT

if you convert the string to integer, it will get rid of the leading zeros

| makeresults
| eval String="00147"
| eval StringInt = tonumber(String)
| table String StringInt

Else if you want to keep it as a string, you can try using this regex
| makeresults
| eval String="00147"
|rex field=String "(?<Output>[^0+]\S+)" 
| table String Output

Re: Use rex to remove leading zeros

cpetterborg — Tue, 08 Jan 2019 02:26:53 GMT

If one of these answers has worked for you, please accept the answer, so that future viewers of this question can know that it has been answered for you, and which one worked for you.

Thanks!

Re: Use rex to remove leading zeros

vnravikumar — Tue, 08 Jan 2019 05:06:14 GMT

Try this

| makeresults 
| eval test=0000123456000001200 
| rex field="test" mode=sed "s/(^0*)//1"

Result: 123456000001200