how to remove a portion of string

[leecholim]

Hi all,

my data as below:

11111_aaaa/ppppaaaa

1110_bb/kjm

I want to remove anything after /, like this

11111_aaaa

1110_bb

Thanks.

[jwalthour]

Use the rex command and have regex cut it down.

| makeresults

| eval foo=“11111_aaaa/ppppaaaa”

| rex field=foo “^(?P<foo>[^\/]*)”

This uses regex on the foo field to take everything from the beginning of that field until the “/“ and assign back to the field foo.

[leecholim]

length before / is different for data...

[leecholim]

thanks, will try.

[gcusello]

Hi @leecholim,

good for you, see next time.

Remember to accept the answer for the other people of Community and Karma Points are appreciated by all the Contributors.

Ciao and happy splunking.

Giuseppe

[jwalthour]

leecholim -

Please mark an answer as your solution once you’ve tried.

[gcusello]

Hi @leecholim,

lenght isn't relevant!

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @leecholim,

let me understand: do you want to remove the part of the event at index time (before indexing) or at search time (when data is displayed)?

In the second case, you have to use a simple regex like this to extract only the part of the field that you want.

E.g.: if the field containing the data to cut is "my_field", try something like this:

| rex field=my_field "^(?<my_new_field>[^\/]*)"

If instead you want to delete the part of the event before indexing, you have to use the SEDCMD command (for more infos see at https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Anonymizedata) but in this case you cannot use the other information contained in the deleted part of the event.

I cannot give you the regex to do this because I need some sample of the full events.

Ciao.

Giuseppe