Splunk Search
Highlighted

Is it possible to remove an asterisk from the returned data for a table

Explorer

Is it possible to remove an asterisk from the returned data for a table?

I tried to use:

rex "Data=(?<Message>[^C]+)\sC" 

however, this ends up cutting off some of the returned data for some lines. I also tried to do eval Message=REPLACE(DATA,"*"," ") and this threw an error.

The example of the returned data in a table would be:

ComputerName; XYZ User: ABC * File Sent to where it needs to go 

What I end up getting is not using anything is:

ComputerName;

Using the rex expression, I get:

ComputerName; XYZ User: ABC File

What I'm hoping to see is:

ComputerName; XYZ User: ABC File Sent to where it needs to go 
0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

SplunkTrust
SplunkTrust

I think you were close. Try eval Message=replace(DATA, "\*", "").

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Explorer

Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.

0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Communicator

Try with this:

rex field=FIELD "\w*[^\*]"
0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Explorer

Hello Sir, rex field=DATA "\w*[^\*]" threw an error -

Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).

0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Communicator

The @woodcock answer is more accurate than mine, forget this 😉

0 Karma
Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Esteemed Legend

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

View solution in original post

Highlighted

Re: Is it possible to remove an asterisk from the returned data for a table

Explorer

I was able to get all the data displayed along with the asterisk by using |rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with |eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.

0 Karma