topic Help with regex to remove first part of string? in Splunk Search

Help with regex to remove first part of string?

tomapatan — Tue, 27 Sep 2022 14:16:22 GMT

I have 2 fields: the values of fieldA are present in fieldB and I need to remove the first part of fieldB up to the values present in fieldA.

For example:

fieldA = BP498

fieldB = "A1John/Doe SmithBP498 XX XX XX"

Desired:

fieldB="BP498 XX XX XX"

Thanks in advance.

Re: regex to remove first part of string

kamlesh_vaghela — Tue, 27 Sep 2022 10:08:03 GMT

@tomapatan

Can you please try this?

YOUR_SEARCH | eval fieldB=fieldA+mvindex(split(fieldB,fieldA),1)

My Sample Search :

| makeresults | eval fieldA = "BP498",fieldB = "A1John/Doe SmithBP498 XX XX XX" | rename comment as "upto this is sample data" | eval fieldB=fieldA+mvindex(split(fieldB,fieldA),1)

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: regex to remove first part of string

FelixLeh — Tue, 27 Sep 2022 10:15:19 GMT

That's a cool way to remove something from a string! I'll add that to my repertoire, thanks!

Re: regex to remove first part of string

tomapatan — Tue, 27 Sep 2022 10:28:33 GMT

worked for me, much appreciated.