topic Re: Remove words from a String in Splunk Search

Remove words from a String

sebafdez — Thu, 02 Mar 2017 22:09:07 GMT

Hi guys!

I need to remove words from 2 char in a string, I have a field like:

comment="La pagina web es muy mala demasiado lenta"

and I want it to be like:

new_comment="pagina web muy mala demasiado lenta"

where words of 2 char doesn't exist anymore, any idea how to implement this in SPL?

regards

Re: Remove words from a String

woodcock — Thu, 02 Mar 2017 22:17:02 GMT

Like this:

...  | rex field=comment mode=sed "s/ .. / /g s/^.. //g s/ ..$//g"

Re: Remove words from a String

somesoni2 — Thu, 02 Mar 2017 22:17:50 GMT

Give this a try (Run anywhere sample search, replace line 1 with your search)

| gentimes start=-1 | eval comment="La pagina web es muy mala demasiado lenta 1 12 123 44" | table comment 
| eval new_comment=replace(comment,"(^|\s)(\w\w)(\s|$)","\1")

Re: Remove words from a String

sebafdez — Fri, 03 Mar 2017 12:27:31 GMT

thanks! works great!