topic Can I remove a part of a string? in Splunk Search

Can I remove a part of a string?

baty0 — Tue, 11 Sep 2018 03:41:41 GMT

Hi,

Is there an eval command that will remove the last part of a string.

For example:
"Installed - 5%" will be come "Installed"
"Not Installed - 95%" will become "Not Installed"
Basically remove " - *%" from a string

Thanks

Re: Can I remove a part of a string?

harishalipaka — Tue, 11 Sep 2018 05:59:50 GMT

hi @baty0

try like this

|makeresults |eval hari="Installed - 5%" |append [| makeresults |eval  hari="Not Installed - 95%" ] |table hari |eval results=split(hari," -") |eval hari=mvindex(results,0) |table hari

Re: Can I remove a part of a string?

mayurr98 — Tue, 11 Sep 2018 09:31:37 GMT

Hey, you can extract using rex command as well. with eval, you would have to use 2 steps and rex is 1 step solution:
Try this

| makeresults 
| eval data="Installed - 5%,Not Installed - 95%" 
| makemv data delim="," 
| mvexpand data 
| table data| rex field=data "(?<newfield>[^\-]+)\s"

let me know if this helps!

Re: Can I remove a part of a string?

zonistj — Tue, 11 Sep 2018 18:00:50 GMT

Hello,

You can use the eval replace() function to replace the " - ##%" values with regex as follows:

| makeresults
| eval foo = "Installed - 5%" 
| eval bar = "Not Installed - 95%"
| eval foo_replaced=replace(foo,"\s\-\s\d+\%",""), bar_replaced=replace(bar,"\s\-\s\d+\%","")

Re: Can I remove a part of a string?

d942725 — Fri, 31 Jan 2020 11:57:08 GMT

I have a use case where i need to pass the previously performed search query to replace the part of message with empty string.

environment="dev" domain="test" logger_name="com.test.practice.demo.sse.impl.EventEncrypter" message="*Data = *"| eval message=replace(message," Data = ","")

The above message in turn obtained must be used to do another operation.

But the replace function itself is not working when i did a splunk search query. I am able to see the log with "Data =" being not removed and came as it is.

I need to do this asap. can u pls provide a solution ?

Re: Can I remove a part of a string?

richgalloway — Fri, 31 Jan 2020 13:30:55 GMT

@d942725 Please post a new question.