Splunk Search

Can you help me build a regex that isolates and removes a single character in a field?

newill
New Member

Hello,

I need some help with removing a specific character from a field. I have a field we'll call A. In it is typically a 7 character string with both numbers and letters. Occasionally, an 8 character value appears and I need to remove the extra character. Here is the format

Typical= A1AAA11  
Atypical = A1AAAB11

I need to isolate the B and remove it. Sometimes the letter represented by B could also be in one of the A spots. So I can't just remove all instances of B or I"d lose legit characters. I need to isolate the 6th spot and if there are 8 total characters, remove it.

How can this be done? I am no good at regex :(.

Thanks for any help.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)

View solution in original post

0 Karma

newill
New Member

Thank you, that got me where I needed to be, though I had to adjust it one spot as such:

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,7,2),A)

0 Karma

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)
0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...