Splunk Search

How to trim off characters before "\"

rbardonetorian
Path Finder

Hello,

Could someone please advise of the most efficient way to trim off everything to the left of a "\" character in a field value?

Running into the escape character thing currently.

Have tried rex and its just too clumsy.

I would like to use something like: eval fieldA=ltrim(tostring(fieldA),"0")
-- putting the "\" characters in place of the "0" above proves no results.

Any ideas?

Thank you!

1 Solution

woodcock
Esteemed Legend

Like this:

| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"

Replace /\\\/" with // to not keep the slash.

View solution in original post

woodcock
Esteemed Legend

Like this:

| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"

Replace /\\\/" with // to not keep the slash.

rbardonetorian
Path Finder

Yes!! 😄 Thx!! sed hurts sometimes.....

0 Karma

woodcock
Esteemed Legend

I didn't expect you to switch Accept, but thank you!

0 Karma

rbardonetorian
Path Finder

I think I just stumbled across the cleanest output related syntax...

| eval fieldA=replace(fieldA,"(\w+)\\\\","+") | eval fieldA=ltrim(tostring(fieldA),"+")

thanks all!!

0 Karma

woodcock
Esteemed Legend

Actually, my answer is more efficient.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...