Splunk Enterprise

How to remove the leading and trailing spaces of the indexedField?

Ashwini008
Communicator

i want to remove the spaces of the leading and trailing of my field.

I am trying to use trim and below Rex both are not working for me.

|eval NewField=trim(OldField)

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

My data

EX:(dots is to show the space)

TR#

CR1K901395........
BT1K901394
CT2K901398        
KMK901397.........
NHK901393

|eval TRIM=trim(TR#) this is throwing me an error.

Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field?

Tags (2)
0 Karma

ITWhisperer
Ultra Champion

What is the error being thrown? Have you tried putting your field name in single quotes?

0 Karma

Ashwini008
Communicator

@ITWhisperer i had missed the quotes but after adding single quotes also i dont see the expected result even though i am not getting any error.

| eval TR#=trim('TR#')

I exported my panel data to see if the spaces are removed but still it is present as shown below

Ashwini008_0-1612768656478.png

 

0 Karma

ITWhisperer
Ultra Champion

It looks like from the graphic that you may have some extended ASCII characters trailing your values - is it these that you want to remove? You could try something like this (again you may need single quotes around the field name)

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

 

0 Karma

Ashwini008
Communicator

@ITWhisperer  when i search my indexed data it looks like below shown 

Ashwini008_0-1612772287933.png

But when i export the same data from panel it looks like this 

Ashwini008_1-1612772338567.png

So i need to make sure when we export the data there are not such characters.

P.s the data indexed in splunk is from sharepoint portal where it is updated TR with trailing Spaces.

Tags (1)
0 Karma

ITWhisperer
Ultra Champion

Did you try the rex?

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

You may need to do the trim as well beforehand and/or remove the $ from the end of the match string 

0 Karma

Ashwini008
Communicator

@ITWhisperer Yes i tried but getting the below error.When i inspect no details found

The search job has failed due to an error. You may be able view the job in the job inspector.

 

Can we use trim function for the FIELD or is it specific to values of the field?

0 Karma

ITWhisperer
Ultra Champion

Try this

| rex field=myField mode=sed "s/[\x80-\xff]*//g"
0 Karma

Ashwini008
Communicator

I dont see error now,but the trailing space isnt removed and the ASCII character is stillpresent when exported.

 

| eval TR#=trim('TR#')
| rex field='TR#' mode=sed "s/[\x80-\xff]*//g"

0 Karma