Splunk Search

How do I formulate the rex command to remove unnecessary spaces in the middle of my field values?

tmaltizo
Path Finder

I have field values that are coming in with unnecessary spaces.
I'm trying to remove them and from another post, I found to use ... | rex mode=sed field=A "s/ //g"
However, I don't want to remove every occurrence of the space in a given value.

Spaces are appearing in the middle of actual words in the values:
Represent ative, Customer Service
Representative, C ustomer Service
Senior Re presentative, Customer Service
Specialis t, Merchant Services

How do I formulate the rex sed command to remove space where there shouldn't be? The field has set values, however the space may occur anywhere in the value. The space after the comma (,) and between whole words is appropriate.

Thanks for any assistance!

somesoni2
Revered Legend

Try this regex.

....|  rex mode=sed field=A "s/([a-zA-Z])\s([a-z])/\1\2/g"

Run anywhere sample code

| gentimes start=-1 | eval A="Represent ative, Customer Service,Representative, C ustomer Service,Senior Re presentative, Customer Service,Specialis t, Merchant Services" | makemv A delim="," | mvexpand A | table A | eval Orig=A | rex mode=sed field=A "s/([a-zA-Z])\s([a-z])/\1\2/g"

tmaltizo
Path Finder

Thanks for your response @somesoni2!

I entered the following into my search...I have to extract the field (title) before I can modify the value. I'm not sure if I have the syntax correct. The field is extracted ok, but the values are still broken with the spaces.

index=..... |rex "title\;.*:(?

0 Karma

tmaltizo
Path Finder

Sorry...somehow the search command cuts off....I basically, extract the field "title" first using "rex "title..." and then i piped your suggested rex after this, but replacing field=A with field=title.

0 Karma

somesoni2
Revered Legend

My rex-sed command was based on the fact that each full word is starting with upper case letter, so that if we get an upper case letter after space, that space is retained, else removed. It should work if the values are following that pattern. Could you confirm if that's the case OR provide some actual sample values? Splunk doesn't have spell check so it would be nearly impossible to identify a full word if there is no pattern.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...