Splunk Search

How to remove spaces from the beginning and end of a field value?

New Member

I want to remove spaces from starting and ending of field

I was trying to achieve this using

... | rex mode=sed field=A "s/ //g"

but it removes all spaces from the field (within the field also).

0 Karma

Splunk Employee
Splunk Employee

The regex from your sed command going to remove single spaces globally from your string anywhere it finds a space. Try stripping repeating whitespace from beginning of line and end of line.

| makeresults 
| eval A=" leading and trailing spaces      " , a_len=len(A)
| rex field=A mode=sed "s/^\s+//g"
| rex field=A mode=sed "s/\s+$//g"
| eval new_len=len(A)
0 Karma

New Member

You can also try this to remove space in both ends

| rex field=myField mode=sed "s/(^\s+)|(\s+$)//g"

Tags (1)
0 Karma

Legend

Have you tried to trim function? .. | eval nospace=trim(A)

Path Finder

trim worked.
but why rex is adding spaces to the value retrieved ?
what should i change in rex to avoid the space, as if i have 5-10 fields extracted, each will have the trailing and leading space to their values.

0 Karma

Motivator
| rex field=field1 "(?<newfield>\S+)"
0 Karma

New Member

I am not able to use trim with
| eval search="$value$"

0 Karma

Legend

you could do | eval search=$value$" | eval search=trim(search) What is the real problem you are trying to solve?

0 Karma

Path Finder

I had this same problem and|eval NewField=trim(OldField) worked great! Thank you so much!