Splunk Search

trim a string

Path Finder

i have a string
14/04/2020|A3|ABC149251|text i really need

can i run something which will trim this string from the end till it get 1st | (pipe symbol)?

i tried rex for this but some error is coming which i am not able to resolve, so thought of taking it the above way.
regular expression i am trying is

(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\ABC\d*|)(?[\w*\s-]+).
getting below error
Error in 'rex' command: Encountered the following error while compiling the regex '(?^\d{2}\/\d{2}\/\d{2,4}|A\d|\INC\d*|)(?[\w*\s-]+)': Regex: unrecognized character follows .

please either correct my regex or let me know how to trim

Tags (3)
0 Karma

Champion

Hi

You can try this also

| makeresults 
| eval str="14/04/2020|A3|ABC149251|text" 
| rex field=str "(?P<output>[^|]+)$"
0 Karma

SplunkTrust
SplunkTrust
your search
| eval result=mvindex(split(_raw,"|"),-1)

no need rex

Path Finder

lovely
it's working
thanks 🙂

0 Karma

SplunkTrust
SplunkTrust

you're welcome and please accept the answer.

0 Karma

Champion

Hi

What is your expected output?

0 Karma

Path Finder

output i am expecting : text i really need

0 Karma