Dashboards & Visualizations

Needs to trim the nos at last in column

uhkc777
Explorer

I have one column which has values like "abcd12","xy3","efg234". I want to trim no.s at the last and needs only string values. How can I do that.

Thanks,

Tags (1)
0 Karma
1 Solution

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

naidusadanala
Communicator

try a regex to strip the values so that its picks only the string values [a-z]

0 Karma

DalJeanis
Legend

This gets rid of numbers only when they are at the end...

| makeresults 
| eval myfield="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield "(?<myfield>.*?[a-zA-Z])\d*$"

...So does this...

| makeresults 
| eval myfield2="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield2 mode=sed "s/[0-9]*$//g"

... and this gets rid of all numbers everywhere...

| makeresults 
| eval myfield3="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield3 mode=sed "s/[0-9]//g"

The first two lines of each group just make test data, the last does the work.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...