topic Re: Replace square brackets and leave original value in Splunk Search

Replace square brackets and leave original value

korstiaans — Mon, 12 Jul 2021 15:36:52 GMT

Hi All,

I have a field with the following value:

[ "842cef72-745d-463c-8b49-ce16ccc5ebd2" ]

I'd like to get rid of the square brackets and the quotes ending up with:

842cef72-745d-463c-8b49-ce16ccc5ebd2

michel_wolf — Mon, 12 Jul 2021 15:46:02 GMT

Hi korstiaans,

you can try this:

|makeresults
|eval sample_field="[ \"842cef72-745d-463c-8b49-ce16ccc5ebd2\" ]"
|rex field=sample_field "\[\s\"(?<new_field>.*)?\""

I don´t know if you have realy spaces between the [ and "

Michel

korstiaans — Mon, 12 Jul 2021 16:35:29 GMT

Hi Michel,

That doesn't work, but it's probably, because the field is a little weird formatted. It looks like this in a table:

clintla — Mon, 12 Jul 2021 17:08:48 GMT

(?<CAPTURE>[a-z0-9-\]+)

clintla — Mon, 12 Jul 2021 17:10:34 GMT

Sorry- added incorrectly \

(?<CAPTURE>[a-z0-9-]+)

korstiaans — Mon, 12 Jul 2021 17:19:20 GMT

@clintla Thanks, works like a charm.