Dashboards & Visualizations

Needs to trim the nos at last in column

uhkc777
Explorer

I have one column which has values like "abcd12","xy3","efg234". I want to trim no.s at the last and needs only string values. How can I do that.

Thanks,

Tags (1)
0 Karma
1 Solution

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

naidusadanala
Communicator

try a regex to strip the values so that its picks only the string values [a-z]

0 Karma

DalJeanis
Legend

This gets rid of numbers only when they are at the end...

| makeresults 
| eval myfield="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield "(?<myfield>.*?[a-zA-Z])\d*$"

...So does this...

| makeresults 
| eval myfield2="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield2 mode=sed "s/[0-9]*$//g"

... and this gets rid of all numbers everywhere...

| makeresults 
| eval myfield3="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield3 mode=sed "s/[0-9]//g"

The first two lines of each group just make test data, the last does the work.

0 Karma
Get Updates on the Splunk Community!

New This Month - Splunk Observability updates and improvements for faster ...

What’s New? This month, we’re delivering several enhancements across Splunk Observability Cloud for faster and ...

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...