Splunk Enterprise

How to remove characters from the end of a field?

ajdyer2000
Path Finder

I have a file called "HelpDeskUsers"

I would like to remove the names from the end of the field.

HelpDesk Users
134-ABC-HelpDesk-Admins Joe
127-ABC-HelpDesk-Admins Mary
178-ABC-HelpDesk-Admins Daniel
189-ABC-HelpDesk-Admins Eva
139-ABC-HelpDesk-Admins Alan

Results:
HelpDesk Users
134-ABC-HelpDesk-Admins 
127-ABC-HelpDesk-Admins 
178-ABC-HelpDesk-Admins 
189-ABC-HelpDesk-Admins 
139-ABC-HelpDesk-Admins

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

your current search with field "HelpDeskUsers"
| eval "HelpDeskUsers"=replace('HelpDeskUsers',"^(.+)\s+\S+$","\1")

View solution in original post

0 Karma

ajdyer2000
Path Finder

Works great thanks

0 Karma

marycordova
SplunkTrust
SplunkTrust

| rex field=HelpDeskUsers "(?<HelpDeskUsers>^[^\s]*)"

pipe | splunk command rex applied to field=fieldname quote paren "( to start the regex capture and name the new field ?<newfieldname> regex ^[^\s]* quote paren to close )"

i like this book to help with regex https://www.amazon.com/Teach-Yourself-Regular-Expressions-Minutes/dp/0672325667

@marycordova
0 Karma

Ayn
Legend

If what you're after is everything before the first space character, this should work:

... | eval HelpDeskUsers=mvindex(split(HelpDeskUsers," "),0)

That is, make a multivalue field out of HelpDeskUsers by splitting it on space characters, then grab the first entry in the newly created multivalue field.

0 Karma

somesoni2
Revered Legend

Try like this

your current search with field "HelpDeskUsers"
| eval "HelpDeskUsers"=replace('HelpDeskUsers',"^(.+)\s+\S+$","\1")
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...