topic Re: How to remove spaces from the beginning and end of a field value? in Splunk Search

How to remove spaces from the beginning and end of a field value?

mkhan_splunk — Wed, 16 Dec 2015 17:06:55 GMT

I want to remove spaces from starting and ending of field

I was trying to achieve this using

... | rex mode=sed field=A "s/ //g"

but it removes all spaces from the field (within the field also).

Re: How to remove spaces from the beginning and end of a field value?

sundareshr — Wed, 16 Dec 2015 17:36:31 GMT

Have you tried to trim function? .. | eval nospace=trim(A)

Re: How to remove spaces from the beginning and end of a field value?

mkhan_splunk — Thu, 17 Dec 2015 17:15:29 GMT

I am not able to use trim with
| eval search="$value$"

Re: How to remove spaces from the beginning and end of a field value?

sundareshr — Thu, 17 Dec 2015 17:31:30 GMT

you could do | eval search=$value$" | eval search=trim(search) What is the real problem you are trying to solve?

Re: How to remove spaces from the beginning and end of a field value?

Phil219 — Thu, 11 Feb 2016 20:06:32 GMT

I had this same problem and|eval NewField=trim(OldField) worked great! Thank you so much!

Re: How to remove spaces from the beginning and end of a field value?

maniishpawar — Fri, 17 Nov 2017 17:35:17 GMT

trim worked.
but why rex is adding spaces to the value retrieved ?
what should i change in rex to avoid the space, as if i have 5-10 fields extracted, each will have the trailing and leading space to their values.

Re: How to remove spaces from the beginning and end of a field value?

shaskell_splunk — Fri, 17 Nov 2017 22:13:38 GMT

The regex from your sed command going to remove single spaces globally from your string anywhere it finds a space. Try stripping repeating whitespace from beginning of line and end of line.

| makeresults 
| eval A=" leading and trailing spaces      " , a_len=len(A)
| rex field=A mode=sed "s/^\s+//g"
| rex field=A mode=sed "s/\s+$//g"
| eval new_len=len(A)

Re: How to remove spaces from the beginning and end of a field value?

landen99 — Tue, 27 Mar 2018 15:58:41 GMT

| rex field=field1 "(?<newfield>\S+)"

Re: How to remove spaces from the beginning and end of a field value?

senthilsisc — Fri, 10 Jul 2020 06:05:17 GMT

You can also try this to remove space in both ends

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"