Splunk Search

Can you help me build a regex that isolates and removes a single character in a field?

newill
New Member

Hello,

I need some help with removing a specific character from a field. I have a field we'll call A. In it is typically a 7 character string with both numbers and letters. Occasionally, an 8 character value appears and I need to remove the extra character. Here is the format

Typical= A1AAA11  
Atypical = A1AAAB11

I need to isolate the B and remove it. Sometimes the letter represented by B could also be in one of the A spots. So I can't just remove all instances of B or I"d lose legit characters. I need to isolate the 6th spot and if there are 8 total characters, remove it.

How can this be done? I am no good at regex :(.

Thanks for any help.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)

View solution in original post

0 Karma

newill
New Member

Thank you, that got me where I needed to be, though I had to adjust it one spot as such:

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,7,2),A)

0 Karma

somesoni2
Revered Legend

Give this a try

your current search which includes field A
| eval A=if(len(A)=8,substr(A,1,5).substr(A,6,2),A)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...