Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- trim a string
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
trim a string
i have a string
14/04/2020|A3|ABC149251|text i really need
can i run something which will trim this string from the end till it get 1st | (pipe symbol)?
i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is
(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .
please either correct my regex or let me know how to trim
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
You can try this also
| makeresults
| eval str="14/04/2020|A3|ABC149251|text"
| rex field=str "(?P<output>[^|]+)$"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
your search
| eval result=mvindex(split(_raw,"|"),-1)
no need rex
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
lovely
it's working
thanks 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you're welcome and please accept the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
What is your expected output?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
output i am expecting : text i really need
Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
