All Apps and Add-ons

Rtrim a period

kragel
Path Finder

I'm trying to use rtrim but when it sees a period it does not remove just the period. It removes extra characters too. I've tried escaping it but I get the same result. I know I'm doing something wrong but I can't figure out how to fix it. Can anyone tell me if there's a way to have rtrim see the period as a period and just remove it? Or any other suggestions? Thanks.

$to$=<someaddress@somedomain.com.procmail>

eval new_to=ltrim(rtrim(to,".procmail>"),"<")

The result is:
$new_to$=someaddress@somed

If I try the following I get the same result

eval new_to=ltrim(rtrim(to,"\.procmail>"),"<")

I'm trying to get

someaddress@somedomain.com

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

...|  eval new_to=replace(replace(to,".procmail>",""),"<","")

OR (overwrite same field)

...| rex field=to mode=sed "s/(\<)(\S+)(\.procmail\>)/\2/g"

View solution in original post

somesoni2
Revered Legend

Try this

...|  eval new_to=replace(replace(to,".procmail>",""),"<","")

OR (overwrite same field)

...| rex field=to mode=sed "s/(\<)(\S+)(\.procmail\>)/\2/g"

kragel
Path Finder

Replace worked. Thank you!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...