topic Re: Extract a field from a search and remove trailing character in Splunk Search

Extract a field from a search and remove trailing character

thenormalone — Tue, 23 Feb 2021 22:41:14 GMT

I have 2 splunk indexes from which I need to gather data from, so I have a simple splunk search (that queries for different timers) which retuns the different timer names used in our service but one of the indexes returns the same timer name with a trailing "_".

Eg: timerName=ABC.transaction_

How can I remove the trailing "_" from the timerName from the results obtained so that when I perform the stats command, it doesn't show the trailing "_"? Also, how can I merge the results from the 2 indexes into one?

Any help is appreciated, thanks!

Re: Extract a field from a search and remove trailing character

thenormalone — Tue, 23 Feb 2021 22:57:36 GMT

I found this to remove the trailing "_" but I still haven't figured out how to merge the two results from the different indexes into one

Re: Extract a field from a search and remove trailing character

scelikok — Wed, 24 Feb 2021 04:46:06 GMT

Hi @thenormalone,

You can use below sample; replace function will replace _ only if it is at the end.

( index=index1 OR index=index2 ) timerName=* | eval timerName = replace(timer_Name,"_$","") | stats count by timerName

Re: Extract a field from a search and remove trailing character

jotne — Wed, 24 Feb 2021 09:09:35 GMT

You can just search for both index at same time and then use SED to remove training _

index=index_1 OR index=index_2 | rex mode=sed field=timerName "s/_$//"

Re: Extract a field from a search and remove trailing character

thenormalone — Tue, 02 Mar 2021 17:32:22 GMT

Those work, thank you! 🙂