topic remove characters in field results in Splunk Search

remove characters in field results

numeroinconnu12 — Mon, 15 Jun 2020 21:22:10 GMT

Morning, everyone,

Thank you in advance for your help.

I would like to remove a part of a character from my results.

My query results look like this:

TRERY\j2874ac
TRERY\k5846de

I'd like to delete the "TRERY\" to get it:

j2874ac
k5846de

How do I proceed? Thank you very much.

bowesmana — Mon, 15 Jun 2020 23:34:08 GMT

The rex statement below will work

| makeresults | eval result=split("TRERY\j2874ac,TRERY\k5846de",",") | mvexpand result | rex field=result mode=sed "s/^TRERY\\\//"

You can run the above example

numeroinconnu12 — Tue, 16 Jun 2020 06:25:27 GMT

Thank you @bowesmana it works.