how to remove start and last character from field value in splunk using single command

[n4niyaz]

how to remove start and last character from field value please find the example below

Example

test=road-car
test=a_road_car-ts
test=road-bus
test=a_road_bus-ts

if i execute stats value result must be road-car=2 and road-bus=2

[woodcock]

Like this (the secret sauce is in the sed command; you may need to adjust the 2 to something different.):

| makeresults|eval test="road-car a_road_car-ts road-bus a_road_bus-ts"
| makemv test
| mvexpand test
| rex field=test mode=sed "s/_/-/g s/^[^-]{1,2}[-]// s/[-][^-]{1,2}$//"
| stats count BY test

[TISKAR]

Can You try this:

| makeresults 
| eval test="road-car,a_road_car-ts,road-bus,a_road_bus-ts"
| makemv delim="," test
| mvexpand test
| rex field=test "(?<test>road[-_][^-]*)"
| replace *_* with *-* IN test

In your request:

<Your_searcg> |  rex field=test "(?<test>road[-_][^-]*)" | replace *_* with *-* IN test

[richgalloway]

The title of your post implies removal of a single character from each end of the field, however, your examples remove multiple characters. There's also a mix of hyphens and underscores. Using your examples as a template, this rex command should do the job for you.

... | rex field=test "(?:\w_)?(?<foo>[-\w]+)(?:-\w\w)?" | stats count by foo | ...

[niketn]

Can you try the following:

 <yourSearch>
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus

Following is a run anywhere search based on sample data provided.

| makeresults
| eval data="test=road-car;test=a_road_car-ts;test=road-bus;test=a_road_bus-ts"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| stats count(eval(match(test,"car"))) as road-car count(eval(match(test,"bus"))) as road-bus