Splunk Search

How to delete unwanted special characters in alphanumeric string?

ravimmm
Explorer

I have a string as below, I need to delete the below special character and make the below as a single value.

123asdsd-123j;123gasds-1234iujh  , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)

Thanks
RK

1 Solution

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

wmyersas
Builder

The simplest route I know is:

| eval field=replace(field,"[^[:word:]]","")

This will replace all non-word characters (ie [0-9a-zA-Z]) with blank ("")

Or:

| eval field=replace(field,"\W","")

\W is any non-word character, too

jacobpevans
Motivator

Definitely simpler!

Also, I didn't know about /W somehow! Thank you!

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder

you're welcome 🙂

0 Karma

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder
0 Karma

ravimmm
Explorer

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...