Splunk Search

How to trim off characters before "\"

rbardonetorian
Path Finder

Hello,

Could someone please advise of the most efficient way to trim off everything to the left of a "\" character in a field value?

Running into the escape character thing currently.

Have tried rex and its just too clumsy.

I would like to use something like: eval fieldA=ltrim(tostring(fieldA),"0")
-- putting the "\" characters in place of the "0" above proves no results.

Any ideas?

Thank you!

1 Solution

woodcock
Esteemed Legend

Like this:

| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"

Replace /\\\/" with // to not keep the slash.

View solution in original post

woodcock
Esteemed Legend

Like this:

| rex field=fieldA mode=sed "s/^[^\\\]*\\\/\\\/"

Replace /\\\/" with // to not keep the slash.

rbardonetorian
Path Finder

Yes!! 😄 Thx!! sed hurts sometimes.....

0 Karma

woodcock
Esteemed Legend

I didn't expect you to switch Accept, but thank you!

0 Karma

rbardonetorian
Path Finder

I think I just stumbled across the cleanest output related syntax...

| eval fieldA=replace(fieldA,"(\w+)\\\\","+") | eval fieldA=ltrim(tostring(fieldA),"+")

thanks all!!

0 Karma

woodcock
Esteemed Legend

Actually, my answer is more efficient.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...