Splunk Search

How to delete unwanted special characters in alphanumeric string?

ravimmm
Explorer

I have a string as below, I need to delete the below special character and make the below as a single value.

123asdsd-123j;123gasds-1234iujh  , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)

Thanks
RK

1 Solution

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

wmyersas
Builder

The simplest route I know is:

| eval field=replace(field,"[^[:word:]]","")

This will replace all non-word characters (ie [0-9a-zA-Z]) with blank ("")

Or:

| eval field=replace(field,"\W","")

\W is any non-word character, too

jacobpevans
Motivator

Definitely simpler!

Also, I didn't know about /W somehow! Thank you!

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder

you're welcome 🙂

0 Karma

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder
0 Karma

ravimmm
Explorer

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...