Remove non alphanumeric in the datamodel

robertlynch2020 — Wed, 12 Apr 2017 14:44:08 GMT

I have datamodel data like below.
I have tried to remove all non alphanumeric. So i can put it on a new field in a datamodel "Add Fields with a Regular Expression" in the datamodel, but i just cant seem to crack it.
I think i need to use a function of some sort as perhaps it is not easy done in REGEX.

I would like to keep the underscores, or replace all the new characters with an underscore is also fine.

^(?P<source_path>/[^0-9!&',-.\\/a-z\n]/)

What i have
peter hi
ex&it
field=1;like&
name
john

What i want
peterhi
exit
field1like
name
john

Cheers in advance

Re: Remove non alphanumeric in the datamodel

mhoogcarspel_sp — Tue, 29 Sep 2020 18:06:21 GMT

Maybe try an eval based field with replace()

I checked it using:
| makeresults | head 1| eval _raw="field = 1;like&" | eval testfield=replace(_raw, "[^0-9&',-.\\/a-z\n]", "")

testfield comes out as: "field1like&"

topic Re: Remove non alphanumeric in the datamodel in Splunk Search

Remove non alphanumeric in the datamodel

Re: Remove non alphanumeric in the datamodel