Splunk Search
Highlighted

How to replace/remove a specific character?

New Member

Hi,

I have the below output :

"(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

The desired output is to remove the first and last '|' : "(01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17)"

My below code isn't working, can you please help me?

Let's say search = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

| eval search = replace (search , "(|" , "(")
| eval search = replace (search , "|)" , ")")

Error : Error in 'eval' command: Regex: missing closing parenthesis
0 Karma
Highlighted

Re: How to replace/remove a specific character?

Motivator

You have to escape the characters in your regex:

| makeresults 1 
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"
| eval test1 = replace (test , "\(\|" , "(")
| eval test2 = replace (test1 , "\|\)" , ")")

Hope this helps

View solution in original post

Highlighted

Re: How to replace/remove a specific character?

New Member

Thanks. - I tried it and it worked.

0 Karma
Highlighted

Re: How to replace/remove a specific character?

Esteemed Legend

Like this:

| makeresults
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)" 
| rex field=test mode=sed "s/\(\|/(/ s/\|\)/)/"
Highlighted

Re: How to replace/remove a specific character?

Motivator

If this is not a one-time thing, you could also make this replacement before ingesting the data by putting this sed in props.conf on the indexer, or even better on the forwarder:

[sourcetype]
SEDCMD-xyz s/\(\|/(/ s/\|\)/)/

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.