Splunk Search

How to replace non-alphanumeric characters in field

oraclebox
Explorer

I have field name transport_route_id may contains non-alphanumeric characters but I want to remove all of them.
Does any know how can I remove them using | rex command?

This part seem cause error.
| field=transport_route_id mode=sed rex "[0-0a-zA-Z]"

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

View solution in original post

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...