topic Re: How to delete unwanted special characters in alphanumeric string? in Splunk Search

How to delete unwanted special characters in alphanumeric string?

ravimmm — Thu, 10 Oct 2019 14:33:37 GMT

I have a string as below, I need to delete the below special character and make the below as a single value.

123asdsd-123j;123gasds-1234iujh  , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)

Thanks
RK

jacobpevans — Thu, 10 Oct 2019 14:48:02 GMT

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

ravimmm — Thu, 10 Oct 2019 14:58:38 GMT

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .

wmyersas — Thu, 10 Oct 2019 15:21:17 GMT

The simplest route I know is:

| eval field=replace(field,"[^[:word:]]","")

This will replace all non-word characters (ie [0-9a-zA-Z]) with blank ("")

Or:

| eval field=replace(field,"\W","")

\W is any non-word character, too

wmyersas — Thu, 10 Oct 2019 15:23:33 GMT

There is an easier way 🙂

jacobpevans — Thu, 10 Oct 2019 19:24:36 GMT

Definitely simpler!

Also, I didn't know about /W somehow! Thank you!

wmyersas — Fri, 11 Oct 2019 13:03:22 GMT

you're welcome 🙂