Splunk Search

How to trim off the last 7 characters from a field?

surekhasplunk
Communicator

Hi,

I have a field with fields as below:

name
--------
abcd - xyz
cdef - xyz
adfeq - xyz

I want to trim "- xyz" from all the rows and display result as below

name
-------
abcd
cdef
adfeq

How to do this using eval substr or trim or rex? please help me with the query

0 Karma
1 Solution

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

View solution in original post

gokadroid
Motivator

Since <space><hyphen><space>xyz are six characters as they appear to naked eye in your text provided hence I am making adjustments to 6 characters rather than 7 which definitely will remove these six in below scenarios:

Rex with extraction:

... | rex field=yourField "^(?<yourNewField>(.*)\s+-\s+xyz)" | table yourNewField

Rex with sed replacement:

... | rex mode=sed field=yourField "s/\ \-\ xyz//g" | table yourField

Eval and substr way:

... | eval yourNewField=substr(yourField , 1, len(yourField )-6) | table yourNewField.

surekhasplunk
Communicator

Thanks it worked perfect !!!

richgalloway
SplunkTrust
SplunkTrust

... | eval name=substr(name, 1, len(name)-7) | ...

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...