Splunk Search

How to remove spaces from the beginning and end of a field value?

mkhan_splunk
New Member

I want to remove spaces from starting and ending of field

I was trying to achieve this using

... | rex mode=sed field=A "s/ //g"

but it removes all spaces from the field (within the field also).

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

The regex from your sed command going to remove single spaces globally from your string anywhere it finds a space. Try stripping repeating whitespace from beginning of line and end of line.

| makeresults 
| eval A=" leading and trailing spaces      " , a_len=len(A)
| rex field=A mode=sed "s/^\s+//g"
| rex field=A mode=sed "s/\s+$//g"
| eval new_len=len(A)
0 Karma

senthilsisc
Engager

You can also try this to remove space in both ends

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

Tags (1)

sundareshr
Legend

Have you tried to trim function? .. | eval nospace=trim(A)

maniishpawar
Path Finder

trim worked.
but why rex is adding spaces to the value retrieved ?
what should i change in rex to avoid the space, as if i have 5-10 fields extracted, each will have the trailing and leading space to their values.

0 Karma

landen99
Motivator
| rex field=field1 "(?<newfield>\S+)"
0 Karma

mkhan_splunk
New Member

I am not able to use trim with
| eval search="$value$"

0 Karma

sundareshr
Legend

you could do | eval search=$value$" | eval search=trim(search) What is the real problem you are trying to solve?

Phil219
Path Finder

I had this same problem and|eval NewField=trim(OldField) worked great! Thank you so much!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...