Splunk Search

Hoew to remove paticular string from the value in a filed?

Veeru
Path Finder

I have the Field with id

i want to  only  3 digits  id For example:
if i take t0123-123 here i want remove t0
t456-456 here i want remove t
t1023-023 here i want to remove t1
The excepted output as shown below:

IDexpected ID
aa
t0123123
t456456
t1023023
Labels (2)
Tags (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

An option other than the one suggested by rrovers is to use the rex command:

 

| makeresults 
| eval id="a,t1023,t456,t0123"
| makemv delim="," id
| mvexpand id
| fields - _time
| rex field=id "(?<expected_id>\w{1,3}$)"

 

This option adds a bit more flexibility given that you can do some validation on the content by changing the regex (e.g. you want only the id's digits just swap \w with \d in the rex command) 

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

rrovers
Contributor
| makeresults 
| eval ID="t1023" 
| eval IDlen=len(ID) 
| eval IDlen2=IDlen-2 
| eval IDtest=substr(ID,IDlen2) 
| table IDtest
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...