Splunk Search

Remove non alphanumeric in the datamodel

robertlynch2020
Influencer

Hi

I have datamodel data like below.
I have tried to remove all non alphanumeric. So i can put it on a new field in a datamodel "Add Fields with a Regular Expression" in the datamodel, but i just cant seem to crack it.
I think i need to use a function of some sort as perhaps it is not easy done in REGEX.

I would like to keep the underscores, or replace all the new characters with an underscore is also fine.

^(?P<source_path>/[^0-9!&',-.\\/a-z\n]/)

What i have
peter hi
ex&it
field=1;like&
name
john

What i want
peterhi
exit
field1like
name
john

alt text
Cheers in advance

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Maybe try an eval based field with replace()

I checked it using:
| makeresults | head 1| eval _raw="field = 1;like&" | eval testfield=replace(_raw, "[^0-9&',-.\\/a-z\n]", "")

testfield comes out as: "field1like&"

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...