Security

How do I trim all characters starting from the first digit?

sshahmoon
New Member

I have a table and I want to trim the values for one field, such that all characters from the first digits onwards are removed
for example:

"dadmin01ldk" will be trimmed to "dadmin"

"rusl90" will be trimmed to "rusl",I have a table with a field.

I want to trim all characters starting at the first digit.

For example, "dadmin02yut" will be trimmed into "dadmin"

Tags (2)
0 Karma

493669
Super Champion

Try this regex-

|rex field=<yourfieldname> "^(?<String>[A-Za-z]+)"

It will trim and store result in String field

0 Karma

sshahmoon
New Member

this works!

thank you!

0 Karma

FrankVl
Ultra Champion

Try this, which captures all non-digits from the start of the field (replace 'yourfield' with the actual fieldname from your table):

| rex field=yourfield "^(<yourfield>\D+)"
0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma

sandeeprachuri
Path Finder

@sshahmoon, FYI, Above rex works too. However, ? is missing in that regex. Try this,
| rex field=yourfield "^(?<yourfield>\D+)"

Thanks,
Sandeep

0 Karma

FrankVl
Ultra Champion

Ah, yes, my bad. Thanks for the correction.

0 Karma

sshahmoon
New Member

could not get it to work

table clienthost | rex field=clienthost "^(\D+)"

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...