Splunk Search

How to trim the unusual brackets from url?

Woodpecker
Path Finder

Hi all,

I have some value under src fields as below, but it has some problems. For example, actually <1b5a.4.d576d0e8-5fbb-4739-a4c7-6dfbc1a4fd2e@avo-sv.one.com> and 1b5a.4.79406b4a-9326-41b2-94cc-2626e10ea6f6@avo-sv.one.com are same & i have multiple src with same issue. I want to remove all "< >" if the string has, so there will not be duplicates. Can anyone help me on this?

Thank you.

Labels (1)
0 Karma
1 Solution

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval trimmed=trim(src,"<>")
0 Karma

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src
0 Karma

Woodpecker
Path Finder

Thankyou @smurf . this worked for me

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...