How to remove the leading and trailing spaces of the indexedField?

[Ashwini008]

i want to remove the spaces of the leading and trailing of my field.

I am trying to use trim and below Rex both are not working for me.

|eval NewField=trim(OldField)

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

My data

EX:(dots is to show the space)

TR#

CR1K901395........
BT1K901394
CT2K901398        
KMK901397.........
NHK901393

|eval TRIM=trim(TR#) this is throwing me an error.

Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field?

[ITWhisperer]

What is the error being thrown? Have you tried putting your field name in single quotes?

[Ashwini008]

@ITWhisperer i had missed the quotes but after adding single quotes also i dont see the expected result even though i am not getting any error.

| eval TR#=trim('TR#')

I exported my panel data to see if the spaces are removed but still it is present as shown below

[ITWhisperer]

It looks like from the graphic that you may have some extended ASCII characters trailing your values - is it these that you want to remove? You could try something like this (again you may need single quotes around the field name)

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

[Ashwini008]

@ITWhisperer  when i search my indexed data it looks like below shown 

But when i export the same data from panel it looks like this 

So i need to make sure when we export the data there are not such characters.

P.s the data indexed in splunk is from sharepoint portal where it is updated TR with trailing Spaces.

[ITWhisperer]

Did you try the rex?

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

You may need to do the trim as well beforehand and/or remove the $ from the end of the match string 

[Ashwini008]

@ITWhisperer Yes i tried but getting the below error.When i inspect no details found

The search job has failed due to an error. You may be able view the job in the job inspector.

Can we use trim function for the FIELD or is it specific to values of the field?

[ITWhisperer]

Try this

| rex field=myField mode=sed "s/[\x80-\xff]*//g"

[Ashwini008]

I dont see error now,but the trailing space isnt removed and the ASCII character is stillpresent when exported.

| eval TR#=trim('TR#')
| rex field='TR#' mode=sed "s/[\x80-\xff]*//g"