Security

How do I trim all characters starting from the first digit?

sshahmoon
New Member

I have a table and I want to trim the values for one field, such that all characters from the first digits onwards are removed
for example:

"dadmin01ldk" will be trimmed to "dadmin"

"rusl90" will be trimmed to "rusl",I have a table with a field.

I want to trim all characters starting at the first digit.

For example, "dadmin02yut" will be trimmed into "dadmin"

Tags (2)
0 Karma

493669
Super Champion

Try this regex-

|rex field=<yourfieldname> "^(?<String>[A-Za-z]+)"

It will trim and store result in String field

0 Karma

sshahmoon
New Member

this works!

thank you!

0 Karma

FrankVl
Ultra Champion

Try this, which captures all non-digits from the start of the field (replace 'yourfield' with the actual fieldname from your table):

| rex field=yourfield "^(<yourfield>\D+)"
0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma

sandeeprachuri
Path Finder

@sshahmoon, FYI, Above rex works too. However, ? is missing in that regex. Try this,
| rex field=yourfield "^(?<yourfield>\D+)"

Thanks,
Sandeep

0 Karma

FrankVl
Ultra Champion

Ah, yes, my bad. Thanks for the correction.

0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...