Splunk Search

Remove Text after Numbers in Field

chrisschum
Path Finder

How can I remove everything after the zeroes in a field with results like this '000000000'

Thanks!

Tags (3)
0 Karma

woodcock
Esteemed Legend

Like this:

|  makeresults 
|  eval yourField = "00000000abcde"
|  rex field=yourField mode=sed "s/^(\d+).*$/\1/"
0 Karma

Sukisen1981
Champion

try this

| makeresults
| eval Description="000000000</ParticipantObjectQuery></ParticipantObjectIdentificat></AuditMessage[greater than sign>"

| rex field=Description "(?<Description>\d+)"
0 Karma

Sukisen1981
Champion

hi @chrisschum
tried the above?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe you need to provide better example of values, as I don't see anything after the zeros (which portion you want to remove). If your data values are like 0000ABCand you want to change the value to 0000, then you'd do like this (in search)

..| eval fieldnamehere=replace(fieldnamehere,"^(0+)(.+)", "\1")

OR

..| rex field=fieldnamehere mode=sed "s/^(0+)(.+)/\1/" 
0 Karma

chrisschum
Path Finder

It took off the full result field because it has a less than and greater than sign

000000000([less than sign]/ParticipantObjectQuery[greater than sign][less than sign]/ParticipantObjectIdentification[greater than sign][less than sign]/AuditMessage[greater than sign]"

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...