Splunk Search

How to replace/remove a specific character?

RRajneesh
New Member

Hi,

I have the below output :

"(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

The desired output is to remove the first and last '|' : "(01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17)"

My below code isn't working, can you please help me?

Let's say search = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"

| eval search = replace (search , "(|" , "(")
| eval search = replace (search , "|)" , ")")

Error : Error in 'eval' command: Regex: missing closing parenthesis
0 Karma
1 Solution

aholzer
Motivator

You have to escape the characters in your regex:

| makeresults 1 
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"
| eval test1 = replace (test , "\(\|" , "(")
| eval test2 = replace (test1 , "\|\)" , ")")

Hope this helps

View solution in original post

woodcock
Esteemed Legend

Like this:

| makeresults
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)" 
| rex field=test mode=sed "s/\(\|/(/ s/\|\)/)/"

wrangler2x
Motivator

If this is not a one-time thing, you could also make this replacement before ingesting the data by putting this sed in props.conf on the indexer, or even better on the forwarder:

[sourcetype]
SEDCMD-xyz s/\(\|/(/ s/\|\)/)/

0 Karma

aholzer
Motivator

You have to escape the characters in your regex:

| makeresults 1 
| eval test = "(|01/01/16|01/01/18|01/05/18|04/02/18|05/01/17|05/05/16|05/08/17|)"
| eval test1 = replace (test , "\(\|" , "(")
| eval test2 = replace (test1 , "\|\)" , ")")

Hope this helps

RRajneesh
New Member

Thanks. - I tried it and it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...