Splunk Enterprise

How to remove characters from the end of a field?

ajdyer2000
Path Finder

I have a file called "HelpDeskUsers"

I would like to remove the names from the end of the field.

HelpDesk Users
134-ABC-HelpDesk-Admins Joe
127-ABC-HelpDesk-Admins Mary
178-ABC-HelpDesk-Admins Daniel
189-ABC-HelpDesk-Admins Eva
139-ABC-HelpDesk-Admins Alan

Results:
HelpDesk Users
134-ABC-HelpDesk-Admins 
127-ABC-HelpDesk-Admins 
178-ABC-HelpDesk-Admins 
189-ABC-HelpDesk-Admins 
139-ABC-HelpDesk-Admins

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search with field "HelpDeskUsers"
| eval "HelpDeskUsers"=replace('HelpDeskUsers',"^(.+)\s+\S+$","\1")

View solution in original post

0 Karma

ajdyer2000
Path Finder

Works great thanks

0 Karma

marycordova
SplunkTrust
SplunkTrust

| rex field=HelpDeskUsers "(?<HelpDeskUsers>^[^\s]*)"

pipe | splunk command rex applied to field=fieldname quote paren "( to start the regex capture and name the new field ?<newfieldname> regex ^[^\s]* quote paren to close )"

i like this book to help with regex https://www.amazon.com/Teach-Yourself-Regular-Expressions-Minutes/dp/0672325667

@marycordova
0 Karma

Ayn
Legend

If what you're after is everything before the first space character, this should work:

... | eval HelpDeskUsers=mvindex(split(HelpDeskUsers," "),0)

That is, make a multivalue field out of HelpDeskUsers by splitting it on space characters, then grab the first entry in the newly created multivalue field.

0 Karma

somesoni2
Revered Legend

Try like this

your current search with field "HelpDeskUsers"
| eval "HelpDeskUsers"=replace('HelpDeskUsers',"^(.+)\s+\S+$","\1")
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...