topic Re: How to remove a carriage return from a field in Splunk Search

How to remove a carriage return from a field

allen_edmondson — Thu, 11 Jul 2013 19:23:49 GMT

I have outputted events in csv format, and have a field which has carriage returns in it. How can use regex to remove the returns only from the field, in the search. Thanks in advance,

Re: How to remove a carriage return from a field

asimagu — Thu, 11 Jul 2013 21:00:55 GMT

do you have more than one carriage return in the field value??

Re: How to remove a carriage return from a field

lguinn2 — Thu, 11 Jul 2013 22:43:18 GMT

This should replace all carriage returns or linefeeds with a space in a field named myField:

yoursearchhere
| eval myField = replace (myField, "[\n\r]"," ")
| morestuffhere

If your data is from Windows and has CRLF in it, this will replace the CRLF with two spaces.

Re: How to remove a carriage return from a field

grijhwani — Thu, 11 Jul 2013 23:45:23 GMT

A refinement would be to make the regex "[\n\r]+" which would see one or more carriage returns or line feeds (or any combination thereof) with a single space.