Splunk Search

how to remove characters from strings

hqw
Path Finder

Hi all,

I have some value under geologic_city fields as below, but it has some problems. For example, actually Anshan and Anshan Shi is the same city, and i have multiple cities have this issue. I want to remove all "Shi" if the string has. Can anyone help me on this?

Thanks

alt text

Tags (3)
1 Solution

javiergn
Super Champion

Try this:

| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))

Careful as it is case sensitive

EDIT. You can have a more granular control (including case insensitive mode) by using rex:

| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"

View solution in original post

javiergn
Super Champion

Try this:

| eval geoloc_city = trim(replace(geoloc_city, "Shi", ""))

Careful as it is case sensitive

EDIT. You can have a more granular control (including case insensitive mode) by using rex:

| rex field=geoloc_city "(?i)^(?<geoloc_city>.+?)(\sShi)?$"

hqw
Path Finder

Thanks a lot javiergn, it works!

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...