Splunk Search

How can I remove excess characters from my fields?

AKG1_old1
Builder

Hi,

In my log file one field called Script Name contains some unnecessary details, which I want to remove.

My requirement is to remove "qcst_" ".sh" and all others arguments like "-LS" "/hp267srv/apps/MXTEST" etc

Actual Data:

qcst_mxStEnvLoad.sh
qcst_ZipLastRun.sh Order_Simulation /hp267srv/apps/MXTEST /net/hp267srv/hp267srv/apps/MXTEST Order_Simulation
qcst_runningProcessesDetails.sh -LS

Expected:

mxStEnvLoad
ZipLastRun
runningProcessesDetails

Thanks
Ankit

0 Karma
1 Solution

sbbadri
Motivator

try this

.... | rex field=_raw "qcst_(?P<field1>\S+).sh"

View solution in original post

alemarzu
Motivator

Hi there @agoyal

Assuming that you already have a field that contains those values (ie, command) you can create a new field from it with the new values, like this.

base search | rex field="command" "^\S+_(?<trimmed_command>[^\.]+)\.\S+"

Hope it helps.

sbbadri
Motivator

try this

.... | rex field=_raw "qcst_(?P<field1>\S+).sh"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...