topic Re: how to remove a portion of string in Splunk Search

how to remove a portion of string

leecholim — Mon, 23 Aug 2021 08:02:31 GMT

Hi all,

my data as below:

11111_aaaa/ppppaaaa

1110_bb/kjm

I want to remove anything after /, like this

11111_aaaa

1110_bb

Thanks.

Re: how to remove a portion of string

gcusello — Mon, 23 Aug 2021 08:14:05 GMT

Hi @leecholim,

let me understand: do you want to remove the part of the event at index time (before indexing) or at search time (when data is displayed)?

In the second case, you have to use a simple regex like this to extract only the part of the field that you want.

E.g.: if the field containing the data to cut is "my_field", try something like this:

| rex field=my_field "^(?<my_new_field>[^\/]*)"

If instead you want to delete the part of the event before indexing, you have to use the SEDCMD command (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Anonymizedata) but in this case you cannot use the other information contained in the deleted part of the event.

I cannot give you the regex to do this because I need some sample of the full events.

Ciao.

Giuseppe

Re: how to remove a portion of string

jwalthour — Mon, 23 Aug 2021 08:16:34 GMT

Use the rex command and have regex cut it down.

| makeresults

| eval foo=“11111_aaaa/ppppaaaa”

| rex field=foo “^(?P<foo>[^\/]*)”

This uses regex on the foo field to take everything from the beginning of that field until the “/“ and assign back to the field foo.

Re: how to remove a portion of string

leecholim — Mon, 23 Aug 2021 08:21:07 GMT

length before / is different for data...

Re: how to remove a portion of string

gcusello — Mon, 23 Aug 2021 08:22:56 GMT

Hi @leecholim,

lenght isn't relevant!

Ciao.

Giuseppe

Re: how to remove a portion of string

leecholim — Mon, 23 Aug 2021 08:27:05 GMT

thanks, will try.

Re: how to remove a portion of string

jwalthour — Mon, 23 Aug 2021 08:30:11 GMT

leecholim -

Please mark an answer as your solution once you’ve tried.

Re: how to remove a portion of string

gcusello — Mon, 23 Aug 2021 08:31:23 GMT

Hi @leecholim,

good for you, see next time.

Remember to accept the answer for the other people of Community and Karma Points are appreciated by all the Contributors.

Ciao and happy splunking.

Giuseppe