topic How to Remove brackets and its content? in Splunk Search

How to Remove brackets and its content?

cedmarjls32 — Mon, 20 Apr 2015 10:29:50 GMT

Hi all,
I have a field named count2 with the following values :
count2
12
32(30)
14
76(23)
3

As mentioned in the title, I'd like to remove the brackets as well as their contents so it would look like this:

count2
12
32
14
76
3

Thanks

stephanefotso — Mon, 20 Apr 2015 10:44:01 GMT

Try regular expression or substr command

  .............  |rex field=count2 "(?<count>[^(])"|table count

cedmarjls32 — Mon, 20 Apr 2015 11:09:29 GMT

Thanks for your feedback but it looks like the rex command only returns the first digit of all values

count
1 instead of 12
3 instead of 32
1 instead of 14
7 instead of 76
etc..

stephanefotso — Mon, 20 Apr 2015 11:46:13 GMT

Ok try this:

   .............  |rex field=count2 "(?<count>\d+)"|table count

or this

 .............  |rex field=count2 "(?<count>\d+)\("|table count

cedmarjls32 — Mon, 20 Apr 2015 11:48:37 GMT

Thanks a lot! It's working great!