trim_end_regex

This page explains how to use the trim_end_regex function in APL.

The trim_end_regex function removes all trailing matches of a regular expression pattern from a string. Use this function to remove complex patterns from string endings, clean structured log suffixes, or normalize data with pattern-based trimming.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use rex with mode=sed for pattern-based trimming. APL’s trim_end_regex provides a more direct approach.

Splunk example

| rex field=field mode=sed "s/pattern$//g"

['sample-http-logs']
| extend cleaned = trim_end_regex('pattern', field)

ANSI SQL users

In ANSI SQL, regex-based trimming requires database-specific functions. APL’s trim_end_regex provides standardized pattern-based trimming.

SQL example

SELECT REGEXP_REPLACE(field, 'pattern$', '') AS cleaned FROM logs;

['sample-http-logs']
| extend cleaned = trim_end_regex('pattern', field)

Usage

Syntax

trim_end_regex(regex, text)

Parameters

Name	Type	Required	Description
regex	string	Yes	The regular expression pattern to remove from the end.
text	string	Yes	The source string to trim.

Returns

Returns the source string with trailing regex matches removed.

Use case examples

Log analysis

Remove trailing numeric suffixes or version numbers from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end_regex('[0-9]+$', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri	method	request_count
/api/users/	GET	2341
/api/orders/	POST	1987

This query removes trailing numeric IDs from URIs, allowing aggregation by endpoint type rather than individual resources.

OpenTelemetry traces

Remove version suffixes from service names using regex patterns.

Query

['otel-demo-traces']
| extend cleaned_service = trim_end_regex('-v[0-9]+[.][0-9]+$', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service	span_count
frontend	4532
checkout	3421
cart	2987

This query removes version number suffixes like ‘-v1.0’ or ‘-v2.3’ from service names, enabling cross-version analysis.

Security logs

Remove trailing hexadecimal session tokens or identifiers from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end_regex('[a-f0-9]{8,}$', uri)
| summarize attempts = count() by cleaned_uri, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_uri	status	failed_attempts
/api/session/	401	234
/admin/token/	403	156

This query removes trailing hexadecimal tokens from URIs, helping identify which endpoints are targeted in authentication attempts without session-specific noise.

List of related functions

• trim_end: Removes trailing characters. Use this for simple character-based trimming without regex.
• trim_regex: Removes both leading and trailing regex matches. Use this for bidirectional pattern trimming.
• replace_regex: Replaces regex matches. Use this when you need to replace patterns rather than just remove trailing ones.
• trim_start_regex: Removes leading regex matches. Use this to trim patterns from the beginning.