Splunk Search

How to replace non-alphanumeric characters in field

oraclebox
Explorer

I have field name transport_route_id may contains non-alphanumeric characters but I want to remove all of them.
Does any know how can I remove them using | rex command?

This part seem cause error.
| field=transport_route_id mode=sed rex "[0-0a-zA-Z]"

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

View solution in original post

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...