Splunk Search

How to trim off the last 7 characters from a field?

surekhasplunk
Communicator

Hi,

I have a field with fields as below:

name
--------
abcd - xyz
cdef - xyz
adfeq - xyz

I want to trim "- xyz" from all the rows and display result as below

name
-------
abcd
cdef
adfeq

How to do this using eval substr or trim or rex? please help me with the query

0 Karma
1 Solution

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

View solution in original post

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

surekhasplunk
Communicator

Thanks it worked perfect !!!

richgalloway
SplunkTrust
SplunkTrust

... | eval name=substr(name, 1, len(name)-7) | ...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...