Splunk Search

How to delete unwanted special characters in alphanumeric string?

ravimmm
Explorer

I have a string as below, I need to delete the below special character and make the below as a single value.

123asdsd-123j;123gasds-1234iujh  , with this create a new field value as 123asdsd123j123gasds1234iujh ( no special characters)

Thanks
RK

1 Solution

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

wmyersas
Builder

The simplest route I know is:

| eval field=replace(field,"[^[:word:]]","")

This will replace all non-word characters (ie [0-9a-zA-Z]) with blank ("")

Or:

| eval field=replace(field,"\W","")

\W is any non-word character, too

jacobpevans
Motivator

Definitely simpler!

Also, I didn't know about /W somehow! Thank you!

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder

you're welcome 🙂

0 Karma

jacobpevans
Motivator

Greetings @ravimmm,

This is the laziest way I can think to do it. I'm sure there's a slightly better way.

| makeresults
| eval test = "123asdsd-123j;123gasds-1234iujh"
| rex field=test max_match=0 "(?<test>\w+)"
| eval test = mvjoin (test, "")

If that doesn't work perfectly for you, you can change \w to be whatever characters you don't want, e.g. [^-;_]

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

wmyersas
Builder
0 Karma

ravimmm
Explorer

Thank you that works , I was looking to regex using [^-;] the whole string without using MAX_MATCH .

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...