topic Re: Is it possible to remove an asterisk from the returned data for a table in Splunk Search

Is it possible to remove an asterisk from the returned data for a table

ruhjuh — Wed, 21 Oct 2015 15:02:03 GMT

Is it possible to remove an asterisk from the returned data for a table?

I tried to use:

rex "Data=(?<Message>[^C]+)\sC"

however, this ends up cutting off some of the returned data for some lines. I also tried to do eval Message=REPLACE(DATA,"*"," ") and this threw an error.

The example of the returned data in a table would be:

ComputerName; XYZ User: ABC * File Sent to where it needs to go

What I end up getting is not using anything is:

ComputerName;

Using the rex expression, I get:

ComputerName; XYZ User: ABC File

What I'm hoping to see is:

ComputerName; XYZ User: ABC File Sent to where it needs to go

Re: Is it possible to remove an asterisk from the returned data for a table

richgalloway — Wed, 21 Oct 2015 15:43:07 GMT

I think you were close. Try eval Message=replace(DATA, "\*", "").

Re: Is it possible to remove an asterisk from the returned data for a table

ruhjuh — Wed, 21 Oct 2015 15:46:55 GMT

Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.

Re: Is it possible to remove an asterisk from the returned data for a table

slr — Wed, 21 Oct 2015 16:16:17 GMT

Try with this:

rex field=FIELD "\w*[^\*]"

Re: Is it possible to remove an asterisk from the returned data for a table

woodcock — Wed, 21 Oct 2015 16:25:40 GMT

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

Re: Is it possible to remove an asterisk from the returned data for a table

ruhjuh — Wed, 21 Oct 2015 16:38:09 GMT

Hello Sir, rex field=DATA "\w*[^\*]" threw an error -

Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).

Re: Is it possible to remove an asterisk from the returned data for a table

ruhjuh — Wed, 21 Oct 2015 17:55:13 GMT

I was able to get all the data displayed along with the asterisk by using |rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with |eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.

Re: Is it possible to remove an asterisk from the returned data for a table

slr — Thu, 22 Oct 2015 07:54:55 GMT

The @woodcock answer is more accurate than mine, forget this 😉