Splunk Search

Remove string from field using REX or Replace

smcdonald20
Path Finder

I have a field, where all values are pre-fixed with "OPTIONS-IT\".
I would like to remove this, but not sure on the best way to do it.

example
User
OPTIONS-IT\smcdonald
OPTIONS-IT\jbloggs

I would like to change to
User
smcdonald
jbloggs

I have tried eval User= replace (User, "OPTIONS-IT\", "") but this doesn't work.

The regular expressions I have used have not worked either.
Any help appreciated.

Tags (2)
0 Karma
1 Solution

dineshraj9
Builder

These methods support regular expression and "\" will be treated as escape character.
Do it this way -

<your search> | rex field=User "OPTIONS.IT.(?<User>\S+)"

OR

<your search> | eval User=replace (User, "OPTIONS\-IT.", "")

View solution in original post

Splunkie
Explorer

I am having a similar issue however in my case the field always has a suffix of sophos_event_input after the username. Example

User

Joe-Smith, Adams sophos_event_input

Jane-Doe, Smith sophos_event_input

I would like to change the User field to

User

Joe-Smith, Adams 

Jane-Doe, Smith 

Basically I want to get rid of the sophos_event_input suffix.

How will I go about this? 

0 Karma

woodcock
Esteemed Legend

Like this (needs more escape characters):

... | rex field=User mode=sed "s/OPTIONS-IT\\\//g"
0 Karma

ljalvrdz
New Member

This one works great! Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi smcdonald20,
Try the following command

your_search | rex field=your_field "OPTIONS-IT\\(?<username>[^ ]*)"

Bye.
Giuseppe

0 Karma

dineshraj9
Builder

These methods support regular expression and "\" will be treated as escape character.
Do it this way -

<your search> | rex field=User "OPTIONS.IT.(?<User>\S+)"

OR

<your search> | eval User=replace (User, "OPTIONS\-IT.", "")

daymauler
Explorer

Worked like charm!!! Thanks

Tags (1)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...