Splunk Search

Why is trim not working when the field has "#"?

_jgpm_
Communicator

I've tried to use the trim, ltrim, and rtrim command on a particular field that contains a "#" field.

I'm not a traditional programmer but it appears the command just fails silently. I've tried it at search-time (e.g. eval test=trim("test#123","#") and i've tried it as a calculated field. Trim("test # 123") also fails to remove the spaces.

Is this a possible bug or am I not using the command correctly? I've read the Eval Functions page and it doesn't capture this case.

I'm on 6.4.3 btw.

Thanks.

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

View solution in original post

niketn
Legend

Trim function is ideally meant to remove spaces, that is when you just provide the input string to the trim function. In Splunk trim, ltrim and rtrim can accept two input parameters i.e. input string and trim character/s. However, you should understand that trim removes the fields only from beginning and/or the end of the input string and not from middle.

This behavior of Trim is not specific to Splunk, it is expected across all languages/technologies.

The output of the following trim command will be a##bc.

eval x=trim("####a##bc###", "#") | table x

Refer to trim eval function on Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

inventsekar
Ultra Champion

yas, trim, as the name suggests, trims only on two edges -
the Leading (or left trim - properly named as "ltrim")
or
the trailing (or right(properly named as "rtrim")) characters.

to do something like, test=trim("test#123","#"), we have to use replace or sed only

0 Karma

Flynt
Splunk Employee
Splunk Employee

I think the issue here is the interpretation of the way trim works. Trim will remove Leading or Trailing characters (or spaces).

For example

| eval test=trim("##test123","#")

Will remove the leading "#"s

If you are just trying to remove the "#" try using replace

|eval test=replace("test#123","#","")

Sed is also a valid case for this

|stats count|fields - count|eval test="test# 123" |rex mode=sed field=test "s/#|\s//g"

For example in the above SPL we remove the "#" and the space.

_jgpm_
Communicator

That's what I ended up doing. I guess this was more due to that I'm not a programmer than the documentation lacking or a bug in Splunk. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...