Splunk Search

Is it possible to remove an asterisk from the returned data for a table

ruhjuh
Explorer

Is it possible to remove an asterisk from the returned data for a table?

I tried to use:

rex "Data=(?<Message>[^C]+)\sC" 

however, this ends up cutting off some of the returned data for some lines. I also tried to do eval Message=REPLACE(DATA,"*"," ") and this threw an error.

The example of the returned data in a table would be:

ComputerName; XYZ User: ABC * File Sent to where it needs to go 

What I end up getting is not using anything is:

ComputerName;

Using the rex expression, I get:

ComputerName; XYZ User: ABC File

What I'm hoping to see is:

ComputerName; XYZ User: ABC File Sent to where it needs to go 
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

View solution in original post

ruhjuh
Explorer

I was able to get all the data displayed along with the asterisk by using |rex "DATA=(?[^$]+)"| where DATA was the indexed column. Then removed the asterisk with |eval Message=replace(Message, "\*", "")| Thanks to all that replied with ideas to help me resolve this issue i was having.

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex field=DATA mode=sed "s/\*//g"

This will remove every asterisk character from the field DATA, regardless of where it may occur.

slr
Communicator

Try with this:

rex field=FIELD "\w*[^\*]"
0 Karma

ruhjuh
Explorer

Hello Sir, rex field=DATA "\w*[^\*]" threw an error -

Error in 'rex' command: The regex '\w*[^*]' does not extract anything. It should specify at least one named group. Format: (?...).

0 Karma

slr
Communicator

The @woodcock answer is more accurate than mine, forget this 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think you were close. Try eval Message=replace(DATA, "\*", "").

---
If this reply helps you, Karma would be appreciated.
0 Karma

ruhjuh
Explorer

Thanks for your reply richgalloway, when i tried that it just populated the table with the ComputerName.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...