topic Re: how to remove start and last character from field value in splunk using single command in Splunk Search

how to remove start and last character from field value in splunk using single command

n4niyaz — Tue, 29 Sep 2020 19:11:20 GMT

how to remove start and last character from field value please find the example below

Example

test=road-car
test=a_road_car-ts
test=road-bus
test=a_road_bus-ts

if i execute stats value result must be road-car=2 and road-bus=2

Re: how to remove start and last character from field value in splunk using single command

niketn — Sat, 21 Apr 2018 18:42:34 GMT

Can you try the following:

 <yourSearch>
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus

Following is a run anywhere search based on sample data provided.

| makeresults
| eval data="test=road-car;test=a_road_car-ts;test=road-bus;test=a_road_bus-ts"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus

Re: how to remove start and last character from field value in splunk using single command

richgalloway — Sat, 21 Apr 2018 18:46:32 GMT

The title of your post implies removal of a single character from each end of the field, however, your examples remove multiple characters. There's also a mix of hyphens and underscores. Using your examples as a template, this rex command should do the job for you.

... | rex field=test "(?:\w_)?(?<foo>[-\w]+)(?:-\w\w)?" | stats count by foo | ...

Re: how to remove start and last character from field value in splunk using single command

TISKAR — Sat, 21 Apr 2018 19:54:38 GMT

Can You try this:

| makeresults 
| eval test="road-car,a_road_car-ts,road-bus,a_road_bus-ts"
| makemv delim="," test
| mvexpand test
| rex field=test "(?<test>road[-_][^-]*)"
| replace *_* with *-* IN test

In your request:

<Your_searcg> |  rex field=test "(?<test>road[-_][^-]*)" | replace *_* with *-* IN test

Re: how to remove start and last character from field value in splunk using single command

woodcock — Sun, 22 Apr 2018 16:43:33 GMT

Like this (the secret sauce is in the sed command; you may need to adjust the 2 to something different.):

| makeresults|eval test="road-car a_road_car-ts road-bus a_road_bus-ts"
| makemv test
| mvexpand test
| rex field=test mode=sed "s/_/-/g s/^[^-]{1,2}[-]// s/[-][^-]{1,2}$//"
| stats count BY test