Splunk Search

How do you use regex to remove duplicate characters?

mistydennis
Communicator

I have a report that requires several fields to be concatenated, each separated by a semicolon. Because some of the fields are null, the values look like this:

cat; dog; ; ; ; snake; bird; ; hamster; ; ;

I want the field to look like this:

cat; dog; snake; bird; hamster

Is there a way to use regex to remove the duplicate semicolons? I'd also like to make sure the field does not end with a semicolon.

Open to other ideas if regex is not the best solution.

Tags (2)
1 Solution

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval msg="cat; dog; ; ; ; snake; bird; ; hamster; ; ;" 
| makemv delim=";" msg 
| eval msg= ltrim(msg) 
| eval msg=mvjoin(mvfilter(msg!=""),";")

View solution in original post

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval msg="cat; dog; ; ; ; snake; bird; ; hamster; ; ;" 
| makemv delim=";" msg 
| eval msg= ltrim(msg) 
| eval msg=mvjoin(mvfilter(msg!=""),";")

mistydennis
Communicator

YES! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...