Splunk Search

How can I eliminate characters or words from the result?

albinortiz
Engager

I have an output that looks like this: AV_DATE=Jan-1-2018

I want to be able to just display the date as so: Jan-1-2018

How can I do that?

Tags (1)
0 Karma

TISKAR
Builder

@ albinortiz , can you test this

| makeresults | eval _raw="AV_DATE=Jan-1-2018"| extract kvdelim="="

OR

| makeresults | eval field="AV_DATE=Jan-1-2018" | rex field=field "AV_DATE=(?<field>.*)"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...