Splunk Search

Is it possible to remove an asterisk from the returned data for a table

Explorer

Is it possible to remove an asterisk from the returned data for a table?

I tried to use:

rex "Data=(?<Message>[^C]+)\sC" 

however, this ends up cutting off some of the returned data for some lines. I also tried to do eval Message=REPLACE(DATA,"*"," ") and this threw an error.

The example of the returned data in a table would be:

ComputerName; XYZ User: ABC * File Sent to where it needs to go 

What I end up getting is not using anything is:

ComputerName;

Using the rex expression, I get:

ComputerName; XYZ User: ABC File

What I'm hoping to see is:

ComputerName; XYZ User: ABC File Sent to where it needs to go 
0 Karma
1 Solution

Esteemed Legend

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

View solution in original post

Explorer

I was able to get all the data displayed along with the asterisk by using |rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with |eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.

0 Karma

Esteemed Legend

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

View solution in original post

Communicator

Try with this:

rex field=FIELD "\w*[^\*]"
0 Karma

Explorer

Hello Sir, rex field=DATA "\w*[^\*]" threw an error -

Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).

0 Karma

Communicator

The @woodcock answer is more accurate than mine, forget this 😉

0 Karma

SplunkTrust
SplunkTrust

I think you were close. Try eval Message=replace(DATA, "\*", "").

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!