Splunk Search

trim a string

vinitpathri
Path Finder

i have a string
14/04/2020|A3|ABC149251|text i really need

can i run something which will trim this string from the end till it get 1st | (pipe symbol)?

i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is

(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .

please either correct my regex or let me know how to trim

Tags (3)
0 Karma

vnravikumar
Champion

Hi

You can try this also

| makeresults 
| eval str="14/04/2020|A3|ABC149251|text" 
| rex field=str "(?P<output>[^|]+)$"
0 Karma

to4kawa
Ultra Champion
your search
| eval result=mvindex(split(_raw,"|"),-1)

no need rex

vinitpathri
Path Finder

lovely
it's working
thanks 🙂

0 Karma

to4kawa
Ultra Champion

you're welcome and please accept the answer.

0 Karma

vnravikumar
Champion

Hi

What is your expected output?

0 Karma

vinitpathri
Path Finder

output i am expecting : text i really need

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...