Splunk Search

How to replace non-alphanumeric characters in field

oraclebox
Explorer

I have field name transport_route_id may contains non-alphanumeric characters but I want to remove all of them.
Does any know how can I remove them using | rex command?

This part seem cause error.
| field=transport_route_id mode=sed rex "[0-0a-zA-Z]"

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

View solution in original post

kristian_kolb
Ultra Champion

The order of the options in the rex command is wrong, and the regular expression has to be in a sed script. This is more correct:

...| rex field=transport_route_id mode=sed "s/[^a-zA-Z0-9]//g"

See more in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

EDIT: forgot to link to docs...

/K

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...