Knowledge Management

How do you remove the first letter of a value?

brienhawker
Explorer

I have a list of usernames of varying lengths. I just need to have the first letter of each username removed. Im guessing it has something to do with ltrim but I dont know what to put in to remove the first random character.

0 Karma
1 Solution

vnravikumar
Champion

Hi

try this

|makeresults |eval msg="sample" | eval result =replace(msg,"^.","")

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Hi @brienhawker,

 .... | eval new_username=substr(username, 1)

vnravikumar
Champion

Hi

try this

|makeresults |eval msg="sample" | eval result =replace(msg,"^.","")

woodcock
Esteemed Legend

Yes, ltrim can do it but get used to using sed like this:

... | rex field=username mode=sed "s/^.//"
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...