Splunk Search

Remove non alphanumeric in the datamodel

robertlynch2020
Motivator

Hi

I have datamodel data like below.
I have tried to remove all non alphanumeric. So i can put it on a new field in a datamodel "Add Fields with a Regular Expression" in the datamodel, but i just cant seem to crack it.
I think i need to use a function of some sort as perhaps it is not easy done in REGEX.

I would like to keep the underscores, or replace all the new characters with an underscore is also fine.

^(?P<source_path>/[^0-9!&',-.\\/a-z\n]/)

What i have
peter hi
ex&it
field=1;like&
name
john

What i want
peterhi
exit
field1like
name
john

alt text
Cheers in advance

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Maybe try an eval based field with replace()

I checked it using:
| makeresults | head 1| eval _raw="field = 1;like&" | eval testfield=replace(_raw, "[^0-9&',-.\\/a-z\n]", "")

testfield comes out as: "field1like&"

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...