Security

How do I trim all characters starting from the first digit?

sshahmoon
New Member

I have a table and I want to trim the values for one field, such that all characters from the first digits onwards are removed
for example:

"dadmin01ldk" will be trimmed to "dadmin"

"rusl90" will be trimmed to "rusl",I have a table with a field.

I want to trim all characters starting at the first digit.

For example, "dadmin02yut" will be trimmed into "dadmin"

Tags (2)
0 Karma

493669
Super Champion

Try this regex-

|rex field=<yourfieldname> "^(?<String>[A-Za-z]+)"

It will trim and store result in String field

0 Karma

sshahmoon
New Member

this works!

thank you!

0 Karma

FrankVl
Ultra Champion

Try this, which captures all non-digits from the start of the field (replace 'yourfield' with the actual fieldname from your table):

| rex field=yourfield "^(<yourfield>\D+)"
0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma

sandeeprachuri
Path Finder

@sshahmoon, FYI, Above rex works too. However, ? is missing in that regex. Try this,
| rex field=yourfield "^(?<yourfield>\D+)"

Thanks,
Sandeep

0 Karma

FrankVl
Ultra Champion

Ah, yes, my bad. Thanks for the correction.

0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...