topic Re: Need help on rtrim command in Splunk Search

Need help on rtrim command

nnimbe1 — Fri, 04 Sep 2020 15:14:00 GMT

Hi Team,

I am using rtrim command to trim some values, but its not working for all the values,as per below screenshot i need to trim everything from _-D in all values, its working for first one for remaining values its not working, can anyone please provide some solution to it. Or in case of any regex please suggest

sap process error.JPG

Re: Need help on rtrim command

ITWhisperer — Fri, 04 Sep 2020 15:22:01 GMT

... | rex field=ARGS "(?<ARGS>.*)_-D"

Re: Need help on rtrim command

vijetagalani — Fri, 04 Sep 2020 18:56:02 GMT

@nnimbe1 You can try the below search. The reason rtrim is working only for few is that you need to specify complete string that needs to be truncated from right. You can either use the rex command or use split and mvindex to get the desired result

index=linux host=* source=ps sapstasrtsrv| eval temp=split(ARGS,"_-d")|eval ARGS=mvindex(temp,0)

Re: Need help on rtrim command

richgalloway — Fri, 04 Sep 2020 19:07:52 GMT

The rtrim command (and ltrim and trim as well) do not take regular expressions. The second argument is a list of characters that will be removed. In the example, four characters will be removed if present: underscore, hyphen, upper-case D, and asterisk.

To remove characters based on a regular expression, use rex mode=sed.

Re: Need help on rtrim command

nnimbe1 — Mon, 07 Sep 2020 14:00:36 GMT

@richgalloway Thanks, but if you can help with rex expression using which if i can exclude everything from _ -D in all values then it will be helpful

Re: Need help on rtrim command

nnimbe1 — Mon, 07 Sep 2020 14:04:00 GMT

@vijetagalani , thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS field then it will be helpful

sap11.JPG

Re: Need help on rtrim command

nnimbe1 — Mon, 07 Sep 2020 14:05:21 GMT

@ITWhisperer ,thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS field then it will be helpfulsap12.JPG

Re: Need help on rtrim command

ITWhisperer — Mon, 07 Sep 2020 14:14:56 GMT

The fact that you are not getting any events has nothing to do with the rex, your base search

index=linux host=* source=ps sapstasrtsrv

is not returning any events for the 24 hour time period you specified. Fix this and reapply the rex