Splunk Search

How can I skip the first two "\n" letters from my fields?

Path Finder

Hello Everyone!

I want to remove the first two letters from my fields "\n" how can I do it?

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

I only want this:

CDIARIA2
CDIARIAC
MAROV91
MAFTB87
MATBU90

Regards!

0 Karma
1 Solution

Engager

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

View solution in original post

SplunkTrust
SplunkTrust

Okay too slow in the morning hours 😉

here is my answer anyway:

| makeresults
| eval foo="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" 
| makemv foo 
| mvexpand foo
| eval jobname=ltrim(foo,"\n") 
| stats count by jobname

The first 4 lines are just to produce dummy data, the ltrim() is the one you can use to remove unwanted characters from the left.

cheers, MuS

SplunkTrust
SplunkTrust

This is neater than mine. +1

0 Karma

SplunkTrust
SplunkTrust

@somesoni2, it is neat, but performance wise yours is better because you are performing the replace after the stats (hence working on less events rather than all). On similar lines, following would be a faster search.

<BaseSearch>
 | stats count by jobname
 | eval jobname=ltrim(foo,"\n") 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Here we go: three Fezzes make up a perfect answer 😉

0 Karma

Path Finder

Thanks so much!

Best Regards!

0 Karma

SplunkTrust
SplunkTrust

Try like this (run anywhere sample search, just add the last eval line to your existing search)

| gentimes start=-1 | eval jobname="\nCDIARIA2 \nCDIARIAC \nMAROV91 \nMAFTB87 \nMATBU90" | makemv jobname | mvexpand jobname | stats count by jobname 
| eval jobname=replace(jobname,"\\\n","")

Contributor

My answer would be same as somesoni

    eval jobname=replace(jobname,"\\\n","")
0 Karma

Path Finder

Thanks so much!

It works!

Best Regards!

0 Karma

Engager

You can use a regex to exclude the first 2 characters. If all of them have \n you could simple use \n(?.+?) with the |rex command.

View solution in original post

SplunkTrust
SplunkTrust

Can you provide more details around how you get these fields, please?

0 Karma

Path Finder

Hello MuS! Thanks for your answer.

This is the query I'm using

index=mf JCL ERROR* |stats count by jobname

An it brings me this but I don't want the \n

jobname count

\nCDIARIA2
\nCDIARIAC
\nMAROV91
\nMAFTB87
\nMATBU90

0 Karma