How to remove spaces from the beginning and end of a field value?

[mkhan_splunk]

I want to remove spaces from starting and ending of field

I was trying to achieve this using

... | rex mode=sed field=A "s/ //g"

but it removes all spaces from the field (within the field also).

[shaskell_splunk]

The regex from your sed command going to remove single spaces globally from your string anywhere it finds a space. Try stripping repeating whitespace from beginning of line and end of line.

| makeresults 
| eval A=" leading and trailing spaces      " , a_len=len(A)
| rex field=A mode=sed "s/^\s+//g"
| rex field=A mode=sed "s/\s+$//g"
| eval new_len=len(A)

[senthilsisc]

You can also try this to remove space in both ends

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

[sundareshr]

Have you tried to trim function? .. | eval nospace=trim(A)

[maniishpawar]

trim worked.
but why rex is adding spaces to the value retrieved ?
what should i change in rex to avoid the space, as if i have 5-10 fields extracted, each will have the trailing and leading space to their values.

[landen99]

| rex field=field1 "(?<newfield>\S+)"

[mkhan_splunk]

I am not able to use trim with
| eval search="$value$"

[sundareshr]

you could do | eval search=$value$" | eval search=trim(search) What is the real problem you are trying to solve?

[Phil219]

I had this same problem and|eval NewField=trim(OldField) worked great! Thank you so much!