topic How do I remove all 1 and 2 character words from a field? in Splunk Search

How do I remove all 1 and 2 character words from a field?

andrewtrobec — Wed, 20 Jun 2018 13:09:55 GMT

Hello,
I have a string field containing many words and I would like to remove all 1 and 2 character words from it. How do I do that? If my first sentence was the field value, the resulting output would be:

have string field containing many words and would like remove all and character words from

Best regards,

Andrew

Re: How do I remove all 1 and 2 character words from a field?

FrankVl — Wed, 20 Jun 2018 13:22:35 GMT

Add the following to your existing search:

| rex field=yourfield mode=sed "s/\b(\w{1,2})\b//g"

https://regex101.com/r/EPipoO/1

Re: How do I remove all 1 and 2 character words from a field?

andrewtrobec — Wed, 27 Jun 2018 14:23:21 GMT

That's the one! Thank you!