Splunk Search

Why is trim not working when the field has "#"?

_jgpm_
Communicator

I've tried to use the trim, ltrim, and rtrim command on a particular field that contains a "#" field.

I'm not a traditional programmer but it appears the command just fails silently. I've tried it at search-time (e.g. eval test=trim("test#123","#") and i've tried it as a calculated field. Trim("test # 123") also fails to remove the spaces.

Is this a possible bug or am I not using the command correctly? I've read the Eval Functions page and it doesn't capture this case.

I'm on 6.4.3 btw.

Thanks.

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

View solution in original post

niketnilay
Legend

Trim function is ideally meant to remove spaces, that is when you just provide the input string to the trim function. In Splunk trim, ltrim and rtrim can accept two input parameters i.e. input string and trim character/s. However, you should understand that trim removes the fields only from beginning and/or the end of the input string and not from middle.

This behavior of Trim is not specific to Splunk, it is expected across all languages/technologies.

The output of the following trim command will be a##bc.

eval x=trim("####a##bc###", "#") | table x

Refer to trim eval function on Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

inventsekar
Super Champion

yas, trim, as the name suggests, trims only on two edges -
the Leading (or left trim - properly named as "ltrim")
or
the trailing (or right(properly named as "rtrim")) characters.

to do something like, test=trim("test#123","#"), we have to use replace or sed only

0 Karma

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

View solution in original post

_jgpm_
Communicator

That's what I ended up doing. I guess this was more due to that I'm not a programmer than the documentation lacking or a bug in Splunk. Thanks.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.