Need help on rtrim command

[nnimbe1]

Hi Team,

I am using rtrim command to trim some values, but its not working for all the values,as per below screenshot i need to trim everything from _-D in all values, its working for first one for remaining values its not working, can anyone please provide some solution to it. Or in case of any regex please suggest

 

[richgalloway]

The rtrim command (and ltrim and trim as well) do not take regular expressions.  The second argument is a list of characters that will be removed.  In the example, four characters will be removed if present: underscore, hyphen, upper-case D, and asterisk.

To remove characters based on a regular expression, use rex mode=sed.

[nnimbe1]

@richgalloway  Thanks, but if you can help with rex expression using which if i can exclude everything from _ -D in all values then it will be helpful

[vijetagalani]

@nnimbe1 You can try the below search. The reason rtrim is working only for few is that you need to specify complete string that needs to be truncated from right. You can either use the rex command or use split and mvindex to get the desired result

index=linux host=*  source=ps sapstasrtsrv| eval temp=split(ARGS,"_-d")|eval ARGS=mvindex(temp,0)

.  

[nnimbe1]

@vijetagalani , thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS  field then it will be helpful

[nnimbe1]

@ITWhisperer ,thanks but unfortunately its not working, if you can help me with rex expression using which i can exclude everything from _-D in ARGS  field then it will be helpful

[ITWhisperer]

The fact that you are not getting any events has nothing to do with the rex, your base search

index=linux host=* source=ps sapstasrtsrv

is not returning any events for the 24 hour time period you specified. Fix this and reapply the rex

[ITWhisperer]

...
| rex field=ARGS "(?<ARGS>.*)_-D"