Splunk Search

Why is trim not working when the field has "#"?

_jgpm_
Communicator

I've tried to use the trim, ltrim, and rtrim command on a particular field that contains a "#" field.

I'm not a traditional programmer but it appears the command just fails silently. I've tried it at search-time (e.g. eval test=trim("test#123","#") and i've tried it as a calculated field. Trim("test # 123") also fails to remove the spaces.

Is this a possible bug or am I not using the command correctly? I've read the Eval Functions page and it doesn't capture this case.

I'm on 6.4.3 btw.

Thanks.

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

View solution in original post

niketn
Legend

Trim function is ideally meant to remove spaces, that is when you just provide the input string to the trim function. In Splunk trim, ltrim and rtrim can accept two input parameters i.e. input string and trim character/s. However, you should understand that trim removes the fields only from beginning and/or the end of the input string and not from middle.

This behavior of Trim is not specific to Splunk, it is expected across all languages/technologies.

The output of the following trim command will be a##bc.

eval x=trim("####a##bc###", "#") | table x

Refer to trim eval function on Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

inventsekar
SplunkTrust
SplunkTrust

yas, trim, as the name suggests, trims only on two edges -
the Leading (or left trim - properly named as "ltrim")
or
the trailing (or right(properly named as "rtrim")) characters.

to do something like, test=trim("test#123","#"), we have to use replace or sed only

0 Karma

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

_jgpm_
Communicator

That's what I ended up doing. I guess this was more due to that I'm not a programmer than the documentation lacking or a bug in Splunk. Thanks.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...