topic Re: regex to remove first occuring numeric values with coma in Splunk Search

regex to remove first occuring numeric values with coma

DataOrg — Wed, 29 Jan 2020 11:33:57 GMT

I want to remove the numeric value and comma which is occurring on the first line beginning

1,Woolworths appoints new chief executive
2,Retailer Woolworths has appointed Roy Bagattini as its new group chief executive officer (CEO), with former chief Ian Moir set to step down on 16 February.
123,Walmart is joining Albertsons and Kroger

Re: regex to remove first occuring numeric values with coma

nickhills — Wed, 29 Jan 2020 11:50:25 GMT

Hi @premranjithj

Try something like this:

your search...|rex field=_raw "^\d+\,(?P<text>.+)$"

If that original string is already extracted to another field, replace _raw with your fieldname.

Let me know if that works!
https://regex101.com/r/W7Ea2p/1

Re: regex to remove first occuring numeric values with coma

vnravikumar — Wed, 29 Jan 2020 12:23:35 GMT

Hi @premranjithj

Try this

| makeresults 
| eval string="1,Woolworths appoints new chief executive#
2,Retailer Woolworths has appointed Roy Bagattini as its new group chief executive officer (CEO), with former chief Ian Moir set to step down on 16 February.#
123,Walmart is joining Albertsons and Kroger" 
| makemv delim="#" string 
| mvexpand string 
| eval temp=split(string,",") 
| eval result=mvindex(temp,1) |table result

Re: regex to remove first occuring numeric values with coma

jawaharas — Wed, 29 Jan 2020 12:29:39 GMT

Where does the '#' comes from?

Re: regex to remove first occuring numeric values with coma

vnravikumar — Wed, 29 Jan 2020 12:46:55 GMT

For creating dummy event I had added # in the text to break

Re: regex to remove first occuring numeric values with coma

DataOrg — Wed, 29 Jan 2020 13:49:25 GMT

@vnravikumar thanks it worked

Re: regex to remove first occuring numeric values with coma

DataOrg — Wed, 29 Jan 2020 13:49:56 GMT

@nickhillscpl cool ! worked , thanks