Splunk Search

How to trim the unusual brackets from url?

Woodpecker
Path Finder

Hi all,

I have some value under src fields as below, but it has some problems. For example, actually <1b5a.4.d576d0e8-5fbb-4739-a4c7-6dfbc1a4fd2e@avo-sv.one.com> and 1b5a.4.79406b4a-9326-41b2-94cc-2626e10ea6f6@avo-sv.one.com are same & i have multiple src with same issue. I want to remove all "< >" if the string has, so there will not be duplicates. Can anyone help me on this?

Thank you.

0 Karma
1 Solution

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval trimmed=trim(src,"<>")
0 Karma

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src
0 Karma

Woodpecker
Path Finder

Thankyou @smurf . this worked for me

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...