trim_regex

This page explains how to use the trim_regex function in APL.

The trim_regex function removes all leading and trailing matches of a regular expression pattern from a string. Use this function to clean strings from both ends using pattern matching, normalize data with complex prefix/suffix patterns, or prepare strings for consistent analysis.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, you use multiple rex commands for bidirectional trimming. APL’s trim_regex handles both ends in one operation.

Splunk example

| rex field=field mode=sed "s/^pattern//g"
| rex field=field mode=sed "s/pattern$//g"

['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)

ANSI SQL users

In ANSI SQL, bidirectional regex trimming requires nested functions. APL’s trim_regex provides a single-function solution.

SQL example

SELECT REGEXP_REPLACE(REGEXP_REPLACE(field, '^pattern', ''), 'pattern$', '') AS cleaned FROM logs;

['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)

Usage

Syntax

trim_regex(regex, text)

Parameters

Name	Type	Required	Description
regex	string	Yes	The regular expression pattern to remove from both ends.
text	string	Yes	The source string to trim.

Returns

Returns the source string with leading and trailing regex matches removed.

Use case examples

Log analysis

Remove leading and trailing slashes or special characters from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_regex('[/]+', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri	method	request_count
api/users	GET	2341
api/orders	POST	1987

This query removes leading and trailing slashes from URIs, normalizing paths for consistent endpoint analysis.

OpenTelemetry traces

Clean service names by removing environment prefixes and version suffixes.

Query

['otel-demo-traces']
| extend cleaned_service = trim_regex('(^(dev|prod|staging)-)|(-v[0-9.]+$)', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service	span_count
frontend	4532
checkout	3421
cart	2987

This query removes both environment prefixes and version suffixes from service names, enabling aggregation across all environments and versions.

Security logs

Remove leading/trailing whitespace and special characters from user identifiers.

Query

['sample-http-logs']
| extend cleaned_id = trim_regex('[^a-zA-Z0-9_]+', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_id	status	attempts
user123	401	45
admin	403	32

This query cleans user IDs by removing whitespace and special characters from both ends, ensuring accurate counting when identifiers have formatting inconsistencies.

List of related functions

• trim: Removes leading and trailing characters. Use this for simple character-based trimming without regex.
• trim_start_regex: Removes leading regex matches. Use this for pattern trimming only from the start.
• trim_end_regex: Removes trailing regex matches. Use this for pattern trimming only from the end.
• replace_regex: Replaces regex matches. Use this when you need to replace patterns anywhere, not just trim ends.