Splunk Search

Hoew to remove paticular string from the value in a filed?

Veeru
Path Finder

I have the Field with id

i want to  only  3 digits  id For example:
if i take t0123-123 here i want remove t0
t456-456 here i want remove t
t1023-023 here i want to remove t1
The excepted output as shown below:

IDexpected ID
aa
t0123123
t456456
t1023023
Labels (2)
Tags (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

An option other than the one suggested by rrovers is to use the rex command:

 

| makeresults 
| eval id="a,t1023,t456,t0123"
| makemv delim="," id
| mvexpand id
| fields - _time
| rex field=id "(?<expected_id>\w{1,3}$)"

 

This option adds a bit more flexibility given that you can do some validation on the content by changing the regex (e.g. you want only the id's digits just swap \w with \d in the rex command) 

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

rrovers
Contributor
| makeresults 
| eval ID="t1023" 
| eval IDlen=len(ID) 
| eval IDlen2=IDlen-2 
| eval IDtest=substr(ID,IDlen2) 
| table IDtest
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...