Splunk Search

trim a string

vinitpathri
Path Finder

i have a string
14/04/2020|A3|ABC149251|text i really need

can i run something which will trim this string from the end till it get 1st | (pipe symbol)?

i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is

(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .

please either correct my regex or let me know how to trim

Tags (3)
0 Karma

vnravikumar
Champion

Hi

You can try this also

| makeresults 
| eval str="14/04/2020|A3|ABC149251|text" 
| rex field=str "(?P<output>[^|]+)$"
0 Karma

to4kawa
Ultra Champion
your search
| eval result=mvindex(split(_raw,"|"),-1)

no need rex

vinitpathri
Path Finder

lovely
it's working
thanks 🙂

0 Karma

to4kawa
Ultra Champion

you're welcome and please accept the answer.

0 Karma

vnravikumar
Champion

Hi

What is your expected output?

0 Karma

vinitpathri
Path Finder

output i am expecting : text i really need

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...