Splunk Search

Trim string after second exclamation mark

mandlikarbaaz
Loves-to-Learn Everything

Hi,
I have a field called SESSION_ID which has a value "0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738!1581997108157"
I want to trim or modify the string from the second exclamation to the last to make it look like this "0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738"
Can someone please help me out!

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval SESSION_ID ="0cdWYCu982HhTjoSYMUgnrCIW8c1apbU!1706637738!1581997108157" 
| eval SESSION_ID=replace(SESSION_ID,"(![^!]+)$","")
0 Karma

nickhills
Ultra Champion

Try:

|rex field=SESSION_ID "(?P<NEW_SESSION_ID>[^!]+![^!]+)"

If my comment helps, please give it a thumbs up!

nickhills
Ultra Champion

If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...