topic Re: regex - exclude multiple parentheses and slashes from a field in Splunk Search

Help with regex - How to exclude multiple parentheses and slashes from a field?

jalo23 — Wed, 31 Aug 2022 14:10:12 GMT

Is there a more elegant way to do this? New to using rex & I can’t seem to strip out the multiple parentheses and slashes from a field without using replace. (I don't have control over the data, I know it is better to strip it out first.) These do work but in some cases there are more parentheses and slashes - is there a way to strip all of them out at once, or do I need to make repeating phrases?

| rex mode=sed field=Field_A "s/\(\)/ /g"

| rex mode=sed field=Field_B "s/\(\)/ /g"

| rex mode=sed field=Field_B "s/\// /g"

Re: regex - exclude multiple parentheses and slashes from a field

richgalloway — Wed, 31 Aug 2022 12:23:30 GMT

You can combine the parentheses and slash into a character class to strip them all out at once. You will, however, need a separate rex command for each field being processed.

| rex mode=sed field=Field_A "s;[\(\)/];;g" | rex mode=sed field=Field_B "s;[\(\)/];;g"

Re: regex - exclude multiple parentheses and slashes from a field

jalo23 — Wed, 31 Aug 2022 12:55:04 GMT

That worked great, thank you!