Splunk Search

How to trim off the last 7 characters from a field?

surekhasplunk
Communicator

Hi,

I have a field with fields as below:

name
--------
abcd - xyz
cdef - xyz
adfeq - xyz

I want to trim "- xyz" from all the rows and display result as below

name
-------
abcd
cdef
adfeq

How to do this using eval substr or trim or rex? please help me with the query

0 Karma
1 Solution

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

View solution in original post

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

surekhasplunk
Communicator

Thanks it worked perfect !!!

richgalloway
SplunkTrust
SplunkTrust

... | eval name=substr(name, 1, len(name)-7) | ...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...