Dashboards & Visualizations

Needs to trim the nos at last in column

uhkc777
Explorer

I have one column which has values like "abcd12","xy3","efg234". I want to trim no.s at the last and needs only string values. How can I do that.

Thanks,

Tags (1)
0 Karma
1 Solution

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

naidusadanala
Communicator

try a regex to strip the values so that its picks only the string values [a-z]

0 Karma

DalJeanis
Legend

This gets rid of numbers only when they are at the end...

| makeresults 
| eval myfield="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield "(?<myfield>.*?[a-zA-Z])\d*$"

...So does this...

| makeresults 
| eval myfield2="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield2 mode=sed "s/[0-9]*$//g"

... and this gets rid of all numbers everywhere...

| makeresults 
| eval myfield3="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield3 mode=sed "s/[0-9]//g"

The first two lines of each group just make test data, the last does the work.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...