Dashboards & Visualizations

Needs to trim the nos at last in column

uhkc777
Explorer

I have one column which has values like "abcd12","xy3","efg234". I want to trim no.s at the last and needs only string values. How can I do that.

Thanks,

Tags (1)
0 Karma
1 Solution

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

Following is a run anywhere search using eval with replace and regular expression based matching group.

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"^([a-zA-Z]+)(\d+)$", "\1")

Or

| makeresults
| eval Original="abcd123"
| eval Trimmed=replace(Original,"(\d+)$", "")

You can also do this with rex and sed

| makeresults
| eval Original="abcd123"
| rex field=Original mode=sed "s/\d//g"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

naidusadanala
Communicator

try a regex to strip the values so that its picks only the string values [a-z]

0 Karma

DalJeanis
Legend

This gets rid of numbers only when they are at the end...

| makeresults 
| eval myfield="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield "(?<myfield>.*?[a-zA-Z])\d*$"

...So does this...

| makeresults 
| eval myfield2="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield2 mode=sed "s/[0-9]*$//g"

... and this gets rid of all numbers everywhere...

| makeresults 
| eval myfield3="LettersThenNumber5inMiddleMoreLetters67" 
| rex field=myfield3 mode=sed "s/[0-9]//g"

The first two lines of each group just make test data, the last does the work.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...