Splunk Search

Remove non alphanumeric in the datamodel

robertlynch2020
Influencer

Hi

I have datamodel data like below.
I have tried to remove all non alphanumeric. So i can put it on a new field in a datamodel "Add Fields with a Regular Expression" in the datamodel, but i just cant seem to crack it.
I think i need to use a function of some sort as perhaps it is not easy done in REGEX.

I would like to keep the underscores, or replace all the new characters with an underscore is also fine.

^(?P<source_path>/[^0-9!&',-.\\/a-z\n]/)

What i have
peter hi
ex&it
field=1;like&
name
john

What i want
peterhi
exit
field1like
name
john

alt text
Cheers in advance

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Maybe try an eval based field with replace()

I checked it using:
| makeresults | head 1| eval _raw="field = 1;like&" | eval testfield=replace(_raw, "[^0-9&',-.\\/a-z\n]", "")

testfield comes out as: "field1like&"

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...