Search code examples
regexsplunksplunk-query

Get rid of characters between two characters in Splunk

I'm currently facing a little problem.

I'm a beginner with Splunk, and I need to print a temperature in a single value widget.

I want the temperature to have °C at the end.

When I'm doing this: | eval value = value +"°C"

The printed value is 80.00 °C.

I want 80°C to be printed.

I also tried to use the Major value and trend which is supposed to allow me to add a unit after a value but it prints it very tiny compared to the temperature value.

Solution

  • Try the eval function round() first (presuming "value" is just a number):

    | eval value=round(value)+"°C"

    Alternatively ... use replace():

    | eval value=replace(value,"\.[^°]+","")