The trim_regex function removes all leading and trailing matches of a regular expression pattern from a string. Use this function to clean strings from both ends using pattern matching, normalize data with complex prefix/suffix patterns, or prepare strings for consistent analysis.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use multiple rex commands for bidirectional trimming. APL's trim_regex handles both ends in one operation.
['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)In ANSI SQL, bidirectional regex trimming requires nested functions. APL's trim_regex provides a single-function solution.
['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)Usage
Syntax
trim_regex(regex, text)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| regex | string | Yes | The regular expression pattern to remove from both ends. |
| text | string | Yes | The source string to trim. |
Returns
Returns the source string with leading and trailing regex matches removed.
Use case examples
Remove leading and trailing slashes or special characters from URIs.
Query
['sample-http-logs']
| extend cleaned_uri = trim_regex('[/]+', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10Output
| cleaned_uri | method | request_count |
|---|---|---|
| api/users | GET | 2341 |
| api/orders | POST | 1987 |
This query removes leading and trailing slashes from URIs, normalizing paths for consistent endpoint analysis.
Clean service names by removing environment prefixes and version suffixes.
Query
['otel-demo-traces']
| extend cleaned_service = trim_regex('(^(dev|prod|staging)-)|(-v[0-9.]+$)', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10Output
| cleaned_service | span_count |
|---|---|
| frontend | 4532 |
| checkout | 3421 |
| cart | 2987 |
This query removes both environment prefixes and version suffixes from service names, enabling aggregation across all environments and versions.
Remove leading/trailing whitespace and special characters from user identifiers.
Query
['sample-http-logs']
| extend cleaned_id = trim_regex('[^a-zA-Z0-9_]+', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10Output
| cleaned_id | status | attempts |
|---|---|---|
| user123 | 401 | 45 |
| admin | 403 | 32 |
This query cleans user IDs by removing whitespace and special characters from both ends, ensuring accurate counting when identifiers have formatting inconsistencies.
List of related functions
- trim: Removes leading and trailing characters. Use this for simple character-based trimming without regex.
- trim_start_regex: Removes leading regex matches. Use this for pattern trimming only from the start.
- trim_end_regex: Removes trailing regex matches. Use this for pattern trimming only from the end.
- replace_regex: Replaces regex matches. Use this when you need to replace patterns anywhere, not just trim ends.