How to remove everything before first occurrence of a character in splunk

user_9340011 0
Viewed 1879

I have a string with certain formate

154787878_2582_test.txt.zip

I need to remove everything before first occurrence of - and remove 154787878_

I have tried

| eval txtFile=replace(mvindex(split(txtFile,"_"),0),"")

Please help

splunk replace regex
1 Answers

You may use

| eval txtFile = replace(txtFile,"^[^_]*_", "")

See the regex demo

The regex matches

  • ^ - start of string
  • [^_]* - 0 or more chars other than _
  • _ - an underscore.
user_38329700
Related