Splunk Search

How to trim the unusual brackets from url?

Woodpecker
Path Finder

Hi all,

I have some value under src fields as below, but it has some problems. For example, actually <1b5a.4.d576d0e8-5fbb-4739-a4c7-6dfbc1a4fd2e@avo-sv.one.com> and 1b5a.4.79406b4a-9326-41b2-94cc-2626e10ea6f6@avo-sv.one.com are same & i have multiple src with same issue. I want to remove all "< >" if the string has, so there will not be duplicates. Can anyone help me on this?

Thank you.

Labels (1)
0 Karma
1 Solution

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval trimmed=trim(src,"<>")
0 Karma

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src
0 Karma

Woodpecker
Path Finder

Thankyou @smurf . this worked for me

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...