topic Re: How to get rid of extra space from the output of a splunk query in Splunk Search

How to get rid of extra space from the output of a splunk query

maramk — Tue, 05 Oct 2021 15:23:27 GMT

Hi Guys,

I have a splunk command which returns a filename as the output. But i found that there is an extra space before and after the filename.

query i am running here is,

filetest | rex "sent to: https://someurl/(?<file>.*)" | table file

Output displayed as:

...............................

..............................

.............................

..............................

file.txt

.............................

...........................

............................

how can i get rid of the extra space before and after the file name?

Thanks.

Re: How to get rid of extra space from the output of a splunk query

Azeemering — Tue, 05 Oct 2021 20:25:21 GMT

Can you try

| rex field=file mode=sed "s/(^\s+)|(\s+$)//g"

Re: How to get rid of extra space from the output of a splunk query

danielcj — Tue, 05 Oct 2021 20:41:33 GMT

Hello,

The extra spaces of the file name are blank spaces? If so, you could use the trim command to remove these spaces like the following:

| rex "sent to: https://someurl/(?<file>.*)" | eval file = trim(file) | table file

Re: How to get rid of extra space from the output of a splunk query

maramk — Tue, 05 Oct 2021 21:35:54 GMT

hi @danielcj ,

Thanks for the response. The above command you suggested doesn't remove extra lines. Its returning the same result before and after.

I am running the query to match a file name from the splunk logs and extracting it to display. But there are empty lines before and after the file name as below.

output:

............................

...........................

..........................

file.txt

.........................

.....................

..................

can you suggest me anything better. Appreciate your response.

Thanks.

Re: How to get rid of extra space from the output of a splunk query

maramk — Tue, 05 Oct 2021 21:38:55 GMT

Hi @Azeemering ,

I tried it as you suggested well. Check the command i run below for my query. Please suggest me if i can make it better to get the file name without empty lines before and after.

filename | rex "uploaded to: s3:someurl/(?<json>.*)" | rex field=json mode=sed "s/(^\s+)|(\s+$)//g" | table json

output still showing as,

................................

..............................

.............................

file.txt

..............................

............................

I have to get rid of those extra lines and display just the file name. I appreciate your help

Thanks.

Re: How to get rid of extra space from the output of a splunk query

maramk — Tue, 05 Oct 2021 22:52:14 GMT

@danielcj and @Azeemering ,

adding "where isnotnull(json)" at the end of the query fixed the issue.

Thanks.