Splunk Search

How to trim the unusual brackets from url?

Woodpecker
Path Finder

Hi all,

I have some value under src fields as below, but it has some problems. For example, actually <1b5a.4.d576d0e8-5fbb-4739-a4c7-6dfbc1a4fd2e@avo-sv.one.com> and 1b5a.4.79406b4a-9326-41b2-94cc-2626e10ea6f6@avo-sv.one.com are same & i have multiple src with same issue. I want to remove all "< >" if the string has, so there will not be duplicates. Can anyone help me on this?

Thank you.

0 Karma
1 Solution

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval trimmed=trim(src,"<>")
0 Karma

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src
0 Karma

Woodpecker
Path Finder

Thankyou @smurf . this worked for me

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...