Splunk Search

Can I remove a part of a string?

baty0
Explorer

Hi,

Is there an eval command that will remove the last part of a string.

For example:
"Installed - 5%" will be come "Installed"
"Not Installed - 95%" will become "Not Installed"
Basically remove " - *%" from a string

Thanks

Tags (1)
0 Karma
1 Solution

harishalipaka
Motivator

hi @baty0

try like this

|makeresults |eval hari="Installed - 5%" |append [| makeresults |eval  hari="Not Installed - 95%" ] |table hari |eval results=split(hari," -") |eval hari=mvindex(results,0) |table hari
Thanks
Harish

View solution in original post

0 Karma

d942725
New Member

I have a use case where i need to pass the previously performed search query to replace the part of message with empty string.

environment="dev" domain="test" logger_name="com.test.practice.demo.sse.impl.EventEncrypter" message="*Data = *"| eval message=replace(message," Data = ","")

The above message in turn obtained must be used to do another operation.

But the replace function itself is not working when i did a splunk search query. I am able to see the log with "Data =" being not removed and came as it is.

I need to do this asap. can u pls provide a solution ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@d942725 Please post a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

zonistj
Path Finder

Hello,

You can use the eval replace() function to replace the " - ##%" values with regex as follows:

| makeresults
| eval foo = "Installed - 5%" 
| eval bar = "Not Installed - 95%"
| eval foo_replaced=replace(foo,"\s\-\s\d+\%",""), bar_replaced=replace(bar,"\s\-\s\d+\%","")
0 Karma

mayurr98
Super Champion

Hey, you can extract using rex command as well. with eval, you would have to use 2 steps and rex is 1 step solution:
Try this

| makeresults 
| eval data="Installed - 5%,Not Installed - 95%" 
| makemv data delim="," 
| mvexpand data 
| table data| rex field=data "(?<newfield>[^\-]+)\s"

let me know if this helps!

0 Karma

harishalipaka
Motivator

hi @baty0

try like this

|makeresults |eval hari="Installed - 5%" |append [| makeresults |eval  hari="Not Installed - 95%" ] |table hari |eval results=split(hari," -") |eval hari=mvindex(results,0) |table hari
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...