Splunk Search

How to trim the unusual brackets from url?

Woodpecker
Path Finder

Hi all,

I have some value under src fields as below, but it has some problems. For example, actually <1b5a.4.d576d0e8-5fbb-4739-a4c7-6dfbc1a4fd2e@avo-sv.one.com> and 1b5a.4.79406b4a-9326-41b2-94cc-2626e10ea6f6@avo-sv.one.com are same & i have multiple src with same issue. I want to remove all "< >" if the string has, so there will not be duplicates. Can anyone help me on this?

Thank you.

Labels (1)
0 Karma
1 Solution

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval trimmed=trim(src,"<>")
0 Karma

smurf
Communicator

Hi,

not sure if this is the most elegant solution, but I would use replace.

| replace <*> with * in src
0 Karma

Woodpecker
Path Finder

Thankyou @smurf . this worked for me

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...