Splunk Search

Why is trim not working when the field has "#"?

_jgpm_
Communicator

I've tried to use the trim, ltrim, and rtrim command on a particular field that contains a "#" field.

I'm not a traditional programmer but it appears the command just fails silently. I've tried it at search-time (e.g. eval test=trim("test#123","#") and i've tried it as a calculated field. Trim("test # 123") also fails to remove the spaces.

Is this a possible bug or am I not using the command correctly? I've read the Eval Functions page and it doesn't capture this case.

I'm on 6.4.3 btw.

Thanks.

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

View solution in original post

Trim function is ideally meant to remove spaces, that is when you just provide the input string to the trim function. In Splunk trim, ltrim and rtrim can accept two input parameters i.e. input string and trim character/s. However, you should understand that trim removes the fields only from beginning and/or the end of the input string and not from middle.

This behavior of Trim is not specific to Splunk, it is expected across all languages/technologies.

The output of the following trim command will be a##bc.

eval x=trim("####a##bc###", "#") | table x

Refer to trim eval function on Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

inventsekar
Super Champion

yas, trim, as the name suggests, trims only on two edges -
the Leading (or left trim - properly named as "ltrim")
or
the trailing (or right(properly named as "rtrim")) characters.

to do something like, test=trim("test#123","#"), we have to use replace or sed only

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

_jgpm_
Communicator

That's what I ended up doing. I guess this was more due to that I'm not a programmer than the documentation lacking or a bug in Splunk. Thanks.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...