CODEWITHSUNDEEP
regexreplacesplunk
Joe
Joe

Reputation: 115

How to remove everything before first occurrence of a character in splunk

I have a string with certain formate

154787878_2582_test.txt.zip

I need to remove everything before first occurrence of - and remove 154787878_

I have tried

| eval txtFile=replace(mvindex(split(txtFile,"_"),0),"")

Please help

Upvotes: 2

Views: 4181

Answers (1)

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 626927

You may use

| eval txtFile = replace(txtFile,"^[^_]*_", "")

See the regex demo

The regex matches

  • ^ - start of string
  • [^_]* - 0 or more chars other than _
  • _ - an underscore.

Upvotes: 4

Related Questions