Splunk Search

Is there an easy way to remove a section of string from a field?

SMM10
Explorer

I want to get an alert and run it but there are items I wanted to remove.

 

| rest "/servicesNS/-/-/saved/searches"
| search title="SomeAlert"
| fields qualifiedSearch

 

So far I am able to get my search but there is a line in there I want to remove, and then display my result. For example if the following was a line in qualifiedSearch.

 

| rename test1 as test, rename operation1 as operation

 

Is there an easy way I can use rex or something else to find this string in qualifiedSearch and remove it?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval search=[| rest splunk_server=local /servicesNS/-/-/saved/searches | where title="SomeAlert" | fields qualifiedSearch | rename qualifiedSearch as query | format "" "" "" "" "" ""]
| eval search=replace(search,"\| rename test1 as test, rename operation1 as operation", "")
| map search="| makeresults | map search="$search$

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval search=[| rest splunk_server=local /servicesNS/-/-/saved/searches | where title="SomeAlert" | fields qualifiedSearch | rename qualifiedSearch as query | format "" "" "" "" "" ""]
| eval search=replace(search,"\| rename test1 as test, rename operation1 as operation", "")
| map search="| makeresults | map search="$search$
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...