Splunk Search

Can you help me build a regex that isolates and removes a single character in a field?

newill
New Member

Hello,

I need some help with removing a specific character from a field. I have a field we'll call A. In it is typically a 7 character string with both numbers and letters. Occasionally, an 8 character value appears and I need to remove the extra character. Here is the format

Typical= A1AAA11  
Atypical = A1AAAB11

I need to isolate the B and remove it. Sometimes the letter represented by B could also be in one of the A spots. So I can't just remove all instances of B or I"d lose legit characters. I need to isolate the 6th spot and if there are 8 total characters, remove it.

How can this be done? I am no good at regex :(.

Thanks for any help.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)

View solution in original post

0 Karma

newill
New Member

Thank you, that got me where I needed to be, though I had to adjust it one spot as such:

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,7,2),A)

0 Karma

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...