Splunk Search

how to remove characters from strings

hqw
Path Finder

Hi all,

I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this?

Thanks

alt text

Tags (3)
1 Solution

javiergn
Super Champion

Try this:

| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))

Careful as it is case sensitive

EDIT. You can have a more granular control (including case insensitive mode) by using rex:

| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"

View solution in original post

javiergn
Super Champion

Try this:

| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))

Careful as it is case sensitive

EDIT. You can have a more granular control (including case insensitive mode) by using rex:

| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"

hqw
Path Finder

Thanks a lot javiergn, it works!

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...