Splunk Search

How to delete unwanted special characters in alphanumeric string?

ravimmm
Explorer

I have a string as below, I need to delete the below special character and make the below as a single value.

123asdsd-123j;123gasds-1234iujh  , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)

Thanks
RK

1 Solution

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

wmyersas
Builder

The simplest route I know is:

| eval field=replace(field,"[^[:word:]]","")

This will replace all non-word characters (ie [0-9a-zA-Z]) with blank ("")

Or:

| eval field=replace(field,"\W","")

\W is any non-word character, too

jacobpevans
Motivator

Definitely simpler!

Also, I didn't know about /W somehow! Thank you!

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder

you're welcome 🙂

0 Karma

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder
0 Karma

ravimmm
Explorer

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...