Splunk Search

How to replace non-alphanumeric characters in field

oraclebox
Explorer

I have field name transport_route_id may contains non-alphanumeric characters but I want to remove all of them.
Does any know how can I remove them using | rex command?

This part seem cause error.
| field=transport_route_id mode=sed rex "[0-0a-zA-Z]"

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

View solution in original post

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...