Splunk Search

How to replace non-alphanumeric characters in field

oraclebox
Explorer

I have field name transport_route_id may contains non-alphanumeric characters but I want to remove all of them.
Does any know how can I remove them using | rex command?

This part seem cause error.
| field=transport_route_id mode=sed rex "[0-0a-zA-Z]"

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

View solution in original post

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...