How to remove all numbers at the beginning of all values for a field?

[ajdyer2000]

Hi

I have a search with a field called "Apps". I would like to be able to remove the leading numeric values. I would like to keep the numbers after the the application name

Apps
100 Microsoft Silverlight
51504280 Microsoft Sync Framework 21 Core Components (x86) ENU
2116480 Microsoft Sync Framework 21 Provider Services (x86) ENU
2116480 Microsoft Sync Framework Runtime v10 SP1 (x86)
377201043810 Oracle Enterprise Single Sign-on Password Reset Client

Thanks
Alan

[woodcock]

Assuming that you mean at search-time, like this:

... | rex field=apps mode=sed "s/^[\d\w]+//"

[s2_splunk]

<your_search> | rex field=Apps "\d+\s(?<ShortApp>.*)"

should produce a new field called "ShortApp" that contains the string after any number of digits, followed by a space.

[s2_splunk]

Or what somesoni2 said... 🙂

[ajdyer2000]

Thanks to everyone

[somesoni2 · Accepted solution]

Give this a try

your current search | eval Apps=replace(Apps,"^\d+\s+","")

OR

your current search | rex field=Apps mode=sed "s/^\d+\s+//g"

[cmerriman]

try a regex

|rex field=Apps "\d+ (?<Apps>.*)"