Splunk Search

How to remove all numbers at the beginning of all values for a field?

ajdyer2000
Path Finder

Hi

I have a search with a field called "Apps". I would like to be able to remove the leading numeric values. I would like to keep the numbers after the the application name

Apps
100 Microsoft Silverlight
51504280 Microsoft Sync Framework 21 Core Components (x86) ENU
2116480 Microsoft Sync Framework 21 Provider Services (x86) ENU
2116480 Microsoft Sync Framework Runtime v10 SP1 (x86)
377201043810 Oracle Enterprise Single Sign-on Password Reset Client

Thanks
Alan

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your current search | eval Apps=replace(Apps,"^\d+\s+","")

OR

your current search | rex field=Apps mode=sed "s/^\d+\s+//g"

View solution in original post

woodcock
Esteemed Legend

Assuming that you mean at search-time, like this:

... | rex field=apps mode=sed "s/^[\d\w]+//"
0 Karma

s2_splunk
Splunk Employee
Splunk Employee
<your_search> | rex field=Apps "\d+\s(?<ShortApp>.*)"

should produce a new field called "ShortApp" that contains the string after any number of digits, followed by a space.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Or what somesoni2 said... 🙂

0 Karma

ajdyer2000
Path Finder

Thanks to everyone

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your current search | eval Apps=replace(Apps,"^\d+\s+","")

OR

your current search | rex field=Apps mode=sed "s/^\d+\s+//g"

cmerriman
Super Champion

try a regex

|rex field=Apps "\d+ (?<Apps>.*)"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...