Splunk Search

How can I skip the first two "\n" letters from my fields?

danielgp89
Path Finder

Hello Everyone!

I want to remove the first two letters from my fields "\n" how can I do it?

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

I only want this:

CDIARIA2
CDIARIAC
MAROV91
MAFTB87
MATBU90

Regards!

0 Karma
1 Solution

oawelewa
Engager

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

View solution in original post

MuS
Legend

Okay too slow in the morning hours 😉

here is my answer anyway:

| makeresults
| eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" 
| makemv foo 
| mvexpand foo
| eval jobname=ltrim(foo,"\n") 
| stats count by jobname

The first 4 lines are just to produce dummy data, the ltrim() is the one you can use to remove unwanted characters from the left.

cheers, MuS

somesoni2
Revered Legend

This is neater than mine. +1

0 Karma

niketn
Legend

@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.

<BaseSearch>
 | stats count by jobname
 | eval jobname=ltrim(foo,"\n") 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

MuS
Legend

Here we go: three Fezzes make up a perfect answer 😉

0 Karma

danielgp89
Path Finder

Thanks so much!

Best Regards!

0 Karma

somesoni2
Revered Legend

Try like this (run anywhere sample search, just add the last eval line to your existing search)

| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname 
| eval jobname=replace(jobname,"\\\n","")

akocak
Contributor

My answer would be same as somesoni

    eval jobname=replace(jobname,"\\\n","")
0 Karma

danielgp89
Path Finder

Thanks so much!

It works!

Best Regards!

0 Karma

oawelewa
Engager

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

MuS
Legend

Can you provide more details around how you get these fields, please?

0 Karma

danielgp89
Path Finder

Hello MuS! Thanks for your answer.

This is the query I'm using

index=mf JCL ERROR* |stats count by jobname

An it brings me this but I don't want the \n

jobname count

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...