https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76028#M19203 <P>though when i put what you provided into <A href="http://regexlib.com/RETester.aspx">http://regexlib.com/RETester.aspx</A><BR /> as: ^[^,]:[^,],(.*)<BR /> with data as: something:anything,stuff1,stuff2,stuff3:stuff4,stuff5</P> <P>nothing comes back.</P> Mon, 01 Oct 2012 18:26:39 GMT dennywebb 2012-10-01T18:26:39Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76025#M19200 <P>i have logs coming in as CSV files, but sometimes junk data is truncated on the front by the system generating them, sometimes not. they are otherwise identical. i have no control on this system.</P> <P>the upside is the junk is always of a certain pattern:<BR /> blah:blah,gooddata,gooddata,gooddata,gooddata,gooddata<BR /> versus the clean ones which are just:<BR /> gooddata,gooddata,gooddata,gooddata,gooddata</P> <P>how do i get a transform to drop that first column before indexing ONLY IF it has X:X as a value?</P> <P>been beating my head against this for 2 days... regex is not my strong point.</P> Mon, 01 Oct 2012 11:28:58 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76025#M19200 dennywebb 2012-10-01T11:28:58Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76026#M19201 <P>Well a regex that will match anything at the beginning of the line until the first comma, with a <CODE>:</CODE> character in it would look like this:</P> <PRE><CODE>^[^,]+:[^,]+, </CODE></PRE> Mon, 01 Oct 2012 11:41:59 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76026#M19201 Ayn 2012-10-01T11:41:59Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76027#M19202 <P>and then i would use the Dest_Key=_Raw in the transform stanza to replace the raw log with my newly cleaned one i presume?</P> Mon, 28 Sep 2020 12:32:21 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76027#M19202 dennywebb 2020-09-28T12:32:21Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76028#M19203 <P>though when i put what you provided into <A href="http://regexlib.com/RETester.aspx">http://regexlib.com/RETester.aspx</A><BR /> as: ^[^,]:[^,],(.*)<BR /> with data as: something:anything,stuff1,stuff2,stuff3:stuff4,stuff5</P> <P>nothing comes back.</P> Mon, 01 Oct 2012 18:26:39 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76028#M19203 dennywebb 2012-10-01T18:26:39Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76029#M19204 <P>Sorry, forgot two <CODE>+</CODE> signs in my regex. Editing my answer with a correct regex.</P> Mon, 01 Oct 2012 18:42:31 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76029#M19204 Ayn 2012-10-01T18:42:31Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76030#M19205 <P>you sir/mam, are the man/woman. the end result:<BR /> ^([^,]+:[^,]+,)?(.*)<BR /> works great. i should be able to just feed $2 back into the raw for either type and always have the same result.</P> Mon, 01 Oct 2012 19:19:06 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76030#M19205 dennywebb 2012-10-01T19:19:06Z https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76031#M19206 <P>an update, installed and working perfectly.</P> Sat, 06 Oct 2012 15:30:51 GMT https://community.splunk.com/t5/Splunk-Search/Transform-to-remove-the-first-column-of-a-CSV-if-it-matches-a/m-p/76031#M19206 dennywebb 2012-10-06T15:30:51Z