i want to remove the spaces of the leading and trailing of my field.
I am trying to use trim and below Rex both are not working for me.
| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"
EX:(dots is to show the space)
|eval TRIM=trim(TR#) this is throwing me an error.
Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field?
@ITWhisperer i had missed the quotes but after adding single quotes also i dont see the expected result even though i am not getting any error.
| eval TR#=trim('TR#')
I exported my panel data to see if the spaces are removed but still it is present as shown below
It looks like from the graphic that you may have some extended ASCII characters trailing your values - is it these that you want to remove? You could try something like this (again you may need single quotes around the field name)
| rex field=myField mode=sed "s/[\u128-\u255]*$//g"
@ITWhisperer when i search my indexed data it looks like below shown
But when i export the same data from panel it looks like this
So i need to make sure when we export the data there are not such characters.
P.s the data indexed in splunk is from sharepoint portal where it is updated TR with trailing Spaces.
@ITWhisperer Yes i tried but getting the below error.When i inspect no details found
The search job has failed due to an error. You may be able view the job in the job inspector.
Can we use trim function for the FIELD or is it specific to values of the field?