https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246437#M73474 <P>So I have some domain information that i'm attempting to format appropriately with EVAL functions either replace, or rtrim, and I seem to be having some difficulty. </P> <P>I'm attempting to shave off the periods before and after the value. Here is the type of values that I'm getting:</P> <PRE><CODE>query=".www.google.com." </CODE></PRE> <P>and this is my eval statement so far:</P> <PRE><CODE>| eval aaa=replace(query, "\".([^\.]+).\", "\1"") </CODE></PRE> <P>It doesn't seem to be taking, so I was wondering if I'm typoing something somewhere? I simply assume my syntax is wrong. <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span> </P> <P>Thank you! </P> Wed, 11 May 2016 19:31:44 GMT tmarlette 2016-05-11T19:31:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246437#M73474 <P>So I have some domain information that i'm attempting to format appropriately with EVAL functions either replace, or rtrim, and I seem to be having some difficulty. </P> <P>I'm attempting to shave off the periods before and after the value. Here is the type of values that I'm getting:</P> <PRE><CODE>query=".www.google.com." </CODE></PRE> <P>and this is my eval statement so far:</P> <PRE><CODE>| eval aaa=replace(query, "\".([^\.]+).\", "\1"") </CODE></PRE> <P>It doesn't seem to be taking, so I was wondering if I'm typoing something somewhere? I simply assume my syntax is wrong. <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span> </P> <P>Thank you! </P> Wed, 11 May 2016 19:31:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246437#M73474 tmarlette 2016-05-11T19:31:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246438#M73475 <P>Try `trim(query, "\."). If you prefer replace, then you need to escape the . (period) characters with a \ (backslash)</P> Wed, 11 May 2016 19:36:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246438#M73475 sundareshr 2016-05-11T19:36:49Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246439#M73476 <P>Worked like a charm, thankyou sir! Here was my final eval statement </P> <PRE><CODE>| eval query=trim(query, "\.\"") </CODE></PRE> Wed, 11 May 2016 20:40:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-replace-trim-statement-to-format-domain/m-p/246439#M73476 tmarlette 2016-05-11T20:40:57Z