Splunk Search

How to remove a comma from a field value?

silasbarnesva
Explorer

Hi all,

We have a field in Splunk that is populated with filenames (e.g.)

G:/some_directory/somefile.txt

Everything works just fine unless users put a comma in as part of the filename:

G:/some_directory/somefile,somemore.txt

Is there a way to remove any commas in the field in question? I've tried the following with no luck:

sourcetype=somesource | rex mode=sed field=filename "s/,//" | table filename

thx!

Tags (3)

somesoni2
SplunkTrust
SplunkTrust

Try any of following method line2 or line 3(the first line is just to generate some sample events, replace it with your base search)

| gentimes start=-1 | eval filename="G:/some_directory/somefile,somemore.txt" | table filename 
| eval filename1=replace(filename,",","") 
| rex field=filename mode=sed "s/,//"
0 Karma

silasbarnesva
Explorer

No dice I'm afraid.

As stated in the question, I've already tried your Line 3 version to no avail. Just tried Line 2 but it doesn't remove those commas which results in other fields being polluted by false data from the field bleeds. Thanks for trying though 🙂

0 Karma

silasbarnesva
Explorer

I think the problem here is that the offending comma doesn't actually populate in the extracted field so it's not able to be rex'd out - it's interpretered as a field separator.

To give a full example of a log entry:

2016-02-11 10:01:00,Minor,PC-Name,Continue, - Caller MD5=105202dad5dd174300xxxxxxxxxxxxxx,File Delete,Begin: 2016-02-11 10:01:00,End: 2016-02-11 10:02:00,Rule: Log files written to USB drives | [AC5-1.1] Log writing to USB drives,7100,C:/Program Files (x86)/Microsoft Office/Office14/EXCEL.EXE,0,No Module Name,D:/some_directory/somefile,somemore.xls,User: MrRobot,Domain: EvilCorp,Action Type: ,File size (bytes): 500000,Device ID: USBSTOR\Disk&Ven_Verbatim&Prod_&Rev_8.00\19120xxxxxxxxx&0

So we know that between Name, and ,User, it shouldn't matter how many commas appear - everything between those two identifiers should = filename.

0 Karma

Jeremiah
Motivator

So the actual problem is that the field is truncated? In your example, the filename field would contain

D:/some_directory/somefile

But you want it to contain

D:/some_directory/somefile,somemore.xls

Could you just hack the field like this?

| rex "Name,(?<filename>.*),User:"
0 Karma

silasbarnesva
Explorer

Thanks Jeremiah,

That works to extract the correct value into the field, but that damn comma still screws up the rest of the field values by throwing them off when they are extracted...for example, the File_Size field returns the User value and the Device_ID field returns the Domain value for affected records...

0 Karma

Jeremiah
Motivator

Ahh ok. Can you put up your props/transforms for this sourcetype? Let's see how the extraction is configured. Thats where I think you'll need to make changes.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...