Splunk Search

How do I formulate the rex command to remove unnecessary spaces in the middle of my field values?

tmaltizo
Path Finder

I have field values that are coming in with unnecessary spaces.
I'm trying to remove them and from another post, I found to use ... | rex mode=sed field=A "s/ //g"
However, I don't want to remove every occurrence of the space in a given value.

Spaces are appearing in the middle of actual words in the values:
Represent ative, Customer Service
Representative, C ustomer Service
Senior Re presentative, Customer Service
Specialis t, Merchant Services

How do I formulate the rex sed command to remove space where there shouldn't be? The field has set values, however the space may occur anywhere in the value. The space after the comma (,) and between whole words is appropriate.

Thanks for any assistance!

somesoni2
Revered Legend

Try this regex.

....|  rex mode=sed field=A "s/([a-zA-Z])\s([a-z])/\1\2/g"

Run anywhere sample code

| gentimes start=-1 | eval A="Represent ative, Customer Service,Representative, C ustomer Service,Senior Re presentative, Customer Service,Specialis t, Merchant Services" | makemv A delim="," | mvexpand A | table A | eval Orig=A | rex mode=sed field=A "s/([a-zA-Z])\s([a-z])/\1\2/g"

tmaltizo
Path Finder

Thanks for your response @somesoni2!

I entered the following into my search...I have to extract the field (title) before I can modify the value. I'm not sure if I have the syntax correct. The field is extracted ok, but the values are still broken with the spaces.

index=..... |rex "title\;.*:(?

0 Karma

tmaltizo
Path Finder

Sorry...somehow the search command cuts off....I basically, extract the field "title" first using "rex "title..." and then i piped your suggested rex after this, but replacing field=A with field=title.

0 Karma

somesoni2
Revered Legend

My rex-sed command was based on the fact that each full word is starting with upper case letter, so that if we get an upper case letter after space, that space is retained, else removed. It should work if the values are following that pattern. Could you confirm if that's the case OR provide some actual sample values? Splunk doesn't have spell check so it would be nearly impossible to identify a full word if there is no pattern.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...