Splunk Search

remove characters in field results

numeroinconnu12
Path Finder

Morning, everyone,

Thank you in advance for your help.

I would like to remove a part of a character from my results.

My query results look like this:

TRERY\j2874ac
TRERY\k5846de

I'd like to delete the "TRERY\" to get it:

j2874ac
k5846de

How do I proceed? Thank you very much.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The rex statement below will work

| makeresults
| eval result=split("TRERY\j2874ac,TRERY\k5846de",",")
| mvexpand result
| rex field=result mode=sed "s/^TRERY\\\//"

You can run the above example

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

The rex statement below will work

| makeresults
| eval result=split("TRERY\j2874ac,TRERY\k5846de",",")
| mvexpand result
| rex field=result mode=sed "s/^TRERY\\\//"

You can run the above example

numeroinconnu12
Path Finder

Thank you @bowesmana  it works. 

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...