topic Re: How to use rex and ltrim to extract this field in my data? in Splunk Search

How to use rex and ltrim to extract this field in my data?

kiran331 — Thu, 16 Feb 2017 22:00:21 GMT

Hi,

I have a field EMP, I need to remove the 0000 present before the field, is this do able?
like, I'm using Rex and ltrim

|rex field=EMP "(?\d{5})$"|eval EMP=if (like (EMP,"0000%"),ltrim(EMP,"0000\\"),EMP)

EMP:
000012345
000000002(its removing all 0's but i need 00001)
0000ABCDEFGH

Expected output;
12345
00002
ABCDEFGH

Re: How to use rex and ltrim to extract this field in my data?

mpreddy — Thu, 16 Feb 2017 22:35:25 GMT

try something like this,

|stats c |eval f="000012345,000000002,0000ABCDEFGH,100000" |eval field=split(f,",") | fields - f | mvexpand field |rex mode=sed field=field  "s/^(0000)(.*)/\2/g"

Re: How to use rex and ltrim to extract this field in my data?

DalJeanis — Thu, 16 Feb 2017 22:46:23 GMT

This makes test data -

| makeresults | eval EMP="000012345 0000ABC 000000002 george" | makemv EMP| mvexpand EMP

this answers the question

| eval EMP2=if (like (EMP,"0000%"),substr(EMP,5,len(EMP)-4),EMP)
| table EMP EMP2

With this result

EMP         EMP2
000012345   12345
0000ABC     ABC
000000002   00002
george      george

Re: How to use rex and ltrim to extract this field in my data?

woodcock — Sun, 19 Feb 2017 01:43:28 GMT

Like this:

.... | rex field=EMP mode=sed "s/^0000//"

Re: How to use rex and ltrim to extract this field in my data?

aaraneta_splunk — Mon, 20 Mar 2017 02:46:17 GMT

@kiran331 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.