- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I have a string as below, I need to delete the below special character and make the below as a single value.
123asdsd-123j;123gasds-1234iujh , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)
Thanks
RK
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Greetings @ravimmm,
This is the laziest way I can think to do it. I'm sure there's a slightly better way.
| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")
If that doesn't work perfectly for you, you can change \w
to be whatever characters you don't want, e.g. [^-;_]
Cheers,
Jacob
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The simplest route I know is:
| eval field=replace(field,"[^[:word:]]","")
This will replace all non-word characters (ie [0-9a-zA-Z]
) with blank (""
)
Or:
| eval field=replace(field,"\W","")
\W
is any non-word character, too
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Definitely simpler!
Also, I didn't know about /W
somehow! Thank you!
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you're welcome 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Greetings @ravimmm,
This is the laziest way I can think to do it. I'm sure there's a slightly better way.
| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")
If that doesn't work perfectly for you, you can change \w
to be whatever characters you don't want, e.g. [^-;_]
Cheers,
Jacob
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is an easier way 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .
