Splunk Search

trim a string

vinitpathri
Path Finder

i have a string
14/04/2020|A3|ABC149251|text i really need

can i run something which will trim this string from the end till it get 1st | (pipe symbol)?

i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is

(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .

please either correct my regex or let me know how to trim

Tags (3)
0 Karma

vnravikumar
Champion

Hi

You can try this also

| makeresults 
| eval str="14/04/2020|A3|ABC149251|text" 
| rex field=str "(?P<output>[^|]+)$"
0 Karma

to4kawa
Ultra Champion
your search
| eval result=mvindex(split(_raw,"|"),-1)

no need rex

vinitpathri
Path Finder

lovely
it's working
thanks 🙂

0 Karma

to4kawa
Ultra Champion

you're welcome and please accept the answer.

0 Karma

vnravikumar
Champion

Hi

What is your expected output?

0 Karma

vinitpathri
Path Finder

output i am expecting : text i really need

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...