topic Re: trim a string in Splunk Search

trim a string

vinitpathri — Wed, 30 Sep 2020 05:21:25 GMT

i have a string
14/04/2020|A3|ABC149251|text i really need

can i run something which will trim this string from the end till it get 1st | (pipe symbol)?

i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is

(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .

please either correct my regex or let me know how to trim

Re: trim a string

vnravikumar — Tue, 12 May 2020 11:08:12 GMT

What is your expected output?

Re: trim a string

to4kawa — Tue, 12 May 2020 11:16:25 GMT

your search
| eval result=mvindex(split(_raw,"|"),-1)

no need rex

Re: trim a string

vinitpathri — Tue, 12 May 2020 11:34:46 GMT

output i am expecting : text i really need

Re: trim a string

vinitpathri — Tue, 12 May 2020 11:36:10 GMT

lovely
it's working
thanks 🙂

Re: trim a string

to4kawa — Tue, 12 May 2020 11:37:32 GMT

you're welcome and please accept the answer.

Re: trim a string

vnravikumar — Tue, 12 May 2020 11:40:31 GMT

You can try this also

| makeresults 
| eval str="14/04/2020|A3|ABC149251|text" 
| rex field=str "(?P<output>[^|]+)$"