Splunk Enterprise

How to remove the leading and trailing spaces of the indexedField?

Ashwini008
Builder

i want to remove the spaces of the leading and trailing of my field.

I am trying to use trim and below Rex both are not working for me.

|eval NewField=trim(OldField)

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

My data

EX:(dots is to show the space)

TR#

CR1K901395........
BT1K901394
CT2K901398        
KMK901397.........
NHK901393

|eval TRIM=trim(TR#) this is throwing me an error.

Cant we use TRIM function to trim the whole field? any suggestions on how can i remove the spaces of the whole field?

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the error being thrown? Have you tried putting your field name in single quotes?

0 Karma

Ashwini008
Builder

@ITWhisperer i had missed the quotes but after adding single quotes also i dont see the expected result even though i am not getting any error.

| eval TR#=trim('TR#')

I exported my panel data to see if the spaces are removed but still it is present as shown below

Ashwini008_0-1612768656478.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like from the graphic that you may have some extended ASCII characters trailing your values - is it these that you want to remove? You could try something like this (again you may need single quotes around the field name)

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

 

0 Karma

Ashwini008
Builder

@ITWhisperer  when i search my indexed data it looks like below shown 

Ashwini008_0-1612772287933.png

But when i export the same data from panel it looks like this 

Ashwini008_1-1612772338567.png

So i need to make sure when we export the data there are not such characters.

P.s the data indexed in splunk is from sharepoint portal where it is updated TR with trailing Spaces.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Did you try the rex?

| rex field=myField mode=sed "s/[\u128-\u255]*$//g"

You may need to do the trim as well beforehand and/or remove the $ from the end of the match string 

0 Karma

Ashwini008
Builder

@ITWhisperer Yes i tried but getting the below error.When i inspect no details found

The search job has failed due to an error. You may be able view the job in the job inspector.

 

Can we use trim function for the FIELD or is it specific to values of the field?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex field=myField mode=sed "s/[\x80-\xff]*//g"
0 Karma

Ashwini008
Builder

I dont see error now,but the trailing space isnt removed and the ASCII character is stillpresent when exported.

 

| eval TR#=trim('TR#')
| rex field='TR#' mode=sed "s/[\x80-\xff]*//g"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...