Splunk Search

Remove string from field using REX or Replace

smcdonald20
Path Finder

I have a field, where all values are pre-fixed with "OPTIONS-IT\".
I would like to remove this, but not sure on the best way to do it.

example
User
OPTIONS-IT\smcdonald
OPTIONS-IT\jbloggs

I would like to change to
User
smcdonald
jbloggs

I have tried eval User= replace (User, "OPTIONS-IT\", "") but this doesn't work.

The regular expressions I have used have not worked either.
Any help appreciated.

Tags (2)
0 Karma
1 Solution

dineshraj9
Builder

These methods support regular expression and "\" will be treated as escape character.
Do it this way -

<your search> | rex field=User "OPTIONS.IT.(?<User>\S+)"

OR

<your search> | eval User=replace (User, "OPTIONS\-IT.", "")

View solution in original post

woodcock
Esteemed Legend

Like this (needs more escape characters):

... | rex field=User mode=sed "s/OPTIONS-IT\\\//g"
0 Karma

ljalvrdz
New Member

This one works great! Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi smcdonald20,
Try the following command

your_search | rex field=your_field "OPTIONS-IT\\(?<username>[^ ]*)"

Bye.
Giuseppe

0 Karma

dineshraj9
Builder

These methods support regular expression and "\" will be treated as escape character.
Do it this way -

<your search> | rex field=User "OPTIONS.IT.(?<User>\S+)"

OR

<your search> | eval User=replace (User, "OPTIONS\-IT.", "")

daymauler
Explorer

Worked like charm!!! Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...