Splunk Search

How do you use regex to remove duplicate characters?

mistydennis
Communicator

I have a report that requires several fields to be concatenated, each separated by a semicolon. Because some of the fields are null, the values look like this:

cat; dog; ; ; ; snake; bird; ; hamster; ; ;

I want the field to look like this:

cat; dog; snake; bird; hamster

Is there a way to use regex to remove the duplicate semicolons? I'd also like to make sure the field does not end with a semicolon.

Open to other ideas if regex is not the best solution.

Tags (2)
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval msg="cat; dog; ; ; ; snake; bird; ; hamster; ; ;" 
| makemv delim=";" msg 
| eval msg= ltrim(msg) 
| eval msg=mvjoin(mvfilter(msg!=""),";")

View solution in original post

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval msg="cat; dog; ; ; ; snake; bird; ; hamster; ; ;" 
| makemv delim=";" msg 
| eval msg= ltrim(msg) 
| eval msg=mvjoin(mvfilter(msg!=""),";")

mistydennis
Communicator

YES! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...