Splunk Search

What regular expression should I use to eliminate a character in the field value?

kiran331
Builder

Hi

What Regex do I have to use to eliminate a character in the field value?

eg:
G0:1K:BF:04:12:2C
expected: G01KBF04122C

0 Karma
1 Solution

sundareshr
Legend

Replace should do it as well

| eval newfield=replace(oldfield, ":", "")

View solution in original post

0 Karma

sundareshr
Legend

Replace should do it as well

| eval newfield=replace(oldfield, ":", "")
0 Karma

schose
Builder

regex should work as descripted. another possibility is to crate/eval a new field

your_search | eval macnew = replace(mac_field, ":","")

Regards,

Andreas

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this

| rex mode=sed "s/\://g"

for learnings,
mode=sed --- to update rex to use sed mode
s/ --- search for
":" ---- escaped ":"
"//" ---- replace it with "empty" string (remove)
/g ----- do this search and replace globally.

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...