How to trim zeros from event contents?

[uagraw01]

Hello Splunkers!!

I have below value 

S000081(=00003102+LCC000060-0000550S00003)

I want to replace above value with

S81(=3102+LCC60-550S3)

Means wherever digit 0 is four times I want to remove those digits.

thanks in advance

[yuanliu]

@PickleRick and @ITWhisperer both made valid points.  You can improve readability by using a semantic expression:

| rex mode=sed "s/0{4}//g" ``` works in _raw events ```

or if the data is already in a named field as your code suggests,

| eval element=replace(element,"0{4}","")

[uagraw01]

@yuanliu Let me try this solution also. 

[PickleRick]

Yours is not equivalent to mine 😉

Mine cuts any two or more zeros (might be expressed as 0{2,}), yours cuts exactly four zeros. Similar but different. In this case of course both will work since the OP's original event contained sequences of four zeros but in general case one might be better than the other (depending on the case).

[uagraw01]

@PickleRick Yes you are right. That is also working for me.

[ITWhisperer]

| eval _raw=replace(_raw, "0000", "")

[PickleRick]

In order to remove strings consiting of more than one consecutive zero (because that's what it seems you want to do  - you didn't specify it more precisely), you can do

| rex mode=sed "s/00+//g

One caveat though - if you have fields extracted from this event, it won't trim contents of those events unless you manually do the same with each field's contents. So that might not be what you really need.

[uagraw01]

@PickleRick  Not sed mode is not working. But I have tried the below one and it is working fine.

| eval element=replace(element,"0000","")

[PickleRick]

Your eval works on a single field, not on raw event's contents. rex with sed mode should work in such case as well, you just have to point it to work on that field, not on a _raw message. But if replace works for you, that's great.