topic Re: Why is trim not working when the field has "#"? in Splunk Search

Why is trim not working when the field has "#"?

_jgpm_ — Wed, 30 Nov 2016 16:56:39 GMT

I've tried to use the trim, ltrim, and rtrim command on a particular field that contains a "#" field.

I'm not a traditional programmer but it appears the command just fails silently. I've tried it at search-time (e.g. eval test=trim("test#123","#") and i've tried it as a calculated field. Trim("test # 123") also fails to remove the spaces.

Is this a possible bug or am I not using the command correctly? I've read the Eval Functions page and it doesn't capture this case.

I'm on 6.4.3 btw.

Thanks.

Re: Why is trim not working when the field has "#"?

Flynt — Wed, 30 Nov 2016 17:24:45 GMT

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

Re: Why is trim not working when the field has "#"?

_jgpm_ — Wed, 30 Nov 2016 17:41:32 GMT

That's what I ended up doing. I guess this was more due to that I'm not a programmer than the documentation lacking or a bug in Splunk. Thanks.

Re: Why is trim not working when the field has "#"?

inventsekar — Wed, 30 Nov 2016 17:42:10 GMT

yas, trim, as the name suggests, trims only on two edges -
the Leading (or left trim - properly named as "ltrim")
or
the trailing (or right(properly named as "rtrim")) characters.

to do something like, test=trim("test#123","#"), we have to use replace or sed only

Re: Why is trim not working when the field has "#"?

niketn — Wed, 30 Nov 2016 17:42:58 GMT

Trim function is ideally meant to remove spaces, that is when you just provide the input string to the trim function. In Splunk trim, ltrim and rtrim can accept two input parameters i.e. input string and trim character/s. However, you should understand that trim removes the fields only from beginning and/or the end of the input string and not from middle.

This behavior of Trim is not specific to Splunk, it is expected across all languages/technologies.

The output of the following trim command will be a##bc.

eval x=trim("####a##bc###", "#") | table x

Refer to trim eval function on Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions