Splunk Search

Regex help please

dmenon
Explorer

I have field username - they show up as username=mike and in some cases username=mike. with a dot in the end. How do I remove the dot from end? This is messing my stats values(xyz) by username.

Tags (1)
0 Karma

vnravikumar
Champion

Hi

Try this also

........| eval username=replace(username,".$","")
0 Karma

woodcock
Esteemed Legend

There are many ways; here is one:

... | rex field=username mode=sed "s/\.+$//g"
0 Karma

vinod94
Contributor

Hi dyude @dmenon ,

You can try this,

rex field=username "(?P<username>[^\.]+)"
0 Karma

jpolvino
Builder

If a period is legal inside, but the line always has to end with a period, this might work for you:
|rex field=username "username=(?<username>.+)\.$"

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dmenon,
if you username hasn't spaces, you can try this:

| rex field=username "^(?<username>\w+)"

that you can test at https://regex101.com/r/mfLTm3/1

if instead you could have spaces in the username field, you could try this:

| rex field=username "^(?<username>.+)(\.|$)"

that you can test at https://regex101.com/r/mfLTm3/2

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...