Splunk Search

How to trim off the last 7 characters from a field?

Communicator

Hi,

I have a field with fields as below:

name
--------
abcd - xyz
cdef - xyz
adfeq - xyz

I want to trim "- xyz" from all the rows and display result as below

name
-------
abcd
cdef
adfeq

How to do this using eval substr or trim or rex? please help me with the query

0 Karma
1 Solution

Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

View solution in original post

Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

View solution in original post

Communicator

Thanks it worked perfect !!!

SplunkTrust
SplunkTrust

... | eval name=substr(name, 1, len(name)-7) | ...

---
If this reply helps you, an upvote would be appreciated.
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!