topic Re: Remove irrelevant 0's from a field value in Splunk Search

Remove irrelevant 0's from a field value

paulw10 — Wed, 26 Feb 2020 12:51:29 GMT

Hey,
I have a field called externalID with values like the following

1766000000009834
1766000000009835
1766000000009836

and i am looking for a way to remove all the 0's in the middle when i output to a table and then rename the field to something like shortID , so the table output would show the following values

17669834
17669835
17669836

I have tried playing around with functions like eval, ltrim, replace...etc and not getting anywhere.

can anyone help me out.

UPDATE:

Hi,
I need help with this problem again.
So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's.

so lets say my external ID is 867182000000921046
i want my table to show 867182921046

but the above options are removing all 0's and giving me 86718292146

any ideas how i can do this.

Re: Remove irrelevant 0's from a field value

richgalloway — Wed, 26 Feb 2020 13:56:17 GMT

There are at least two ways to do that.

... | eval externalID = replace(externalID, "0{2,}", "")

... | rex field = externalID mode=sed "s/0{2,}//g"

Re: Remove irrelevant 0's from a field value

vnravikumar — Wed, 26 Feb 2020 14:09:05 GMT

Try this also

| makeresults 
| eval test=17660000009834 
| rex field=test max_match=0 "(?P<temp>[1-9]+)" 
| eval result = mvjoin(temp,"") 
| table test,result

Re: Remove irrelevant 0's from a field value

paulw10 — Wed, 26 Feb 2020 14:56:36 GMT

Excellent. thank you both

Re: Remove irrelevant 0's from a field value

paulw10 — Thu, 26 Mar 2020 14:06:26 GMT

Hi,
I need help with this problem again.
So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's.

so lets say my external ID is 867182000000921046
i want my table to show 867182921046

but the above options are removing all 0's and giving me 86718292146

any ideas how i can do this.

Re: Remove irrelevant 0's from a field value

paulw10 — Thu, 26 Mar 2020 14:06:35 GMT

Hi,
I need help with this problem again.
So as previously stated i only want to remove the zero's in the middle , but the options given above seem to remove all 0's.

so lets say my external ID is 867182000000921046
i want my table to show 867182921046

but the above options are removing all 0's and giving me 86718292146

any ideas how i can do this.

Re: Remove irrelevant 0's from a field value

richgalloway — Fri, 27 Mar 2020 12:43:57 GMT

Please see my updated answer.