Skip to main content
The trim_end_regex function removes all trailing matches of a regular expression pattern from a string. Use this function to remove complex patterns from string endings, clean structured log suffixes, or normalize data with pattern-based trimming.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use rex with mode=sed for pattern-based trimming. APL’s trim_end_regex provides a more direct approach.
| rex field=field mode=sed "s/pattern$//g"
In ANSI SQL, regex-based trimming requires database-specific functions. APL’s trim_end_regex provides standardized pattern-based trimming.
SELECT REGEXP_REPLACE(field, 'pattern$', '') AS cleaned FROM logs;

Usage

Syntax

trim_end_regex(regex, text)

Parameters

NameTypeRequiredDescription
regexstringYesThe regular expression pattern to remove from the end.
textstringYesThe source string to trim.

Returns

Returns the source string with trailing regex matches removed.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Remove trailing numeric suffixes or version numbers from URIs.Query
['sample-http-logs']
| extend cleaned_uri = trim_end_regex('[0-9]+$', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
cleaned_urimethodrequest_count
/api/users/GET2341
/api/orders/POST1987
This query removes trailing numeric IDs from URIs, allowing aggregation by endpoint type rather than individual resources.
  • trim_end: Removes trailing characters. Use this for simple character-based trimming without regex.
  • trim_regex: Removes both leading and trailing regex matches. Use this for bidirectional pattern trimming.
  • replace_regex: Replaces regex matches. Use this when you need to replace patterns rather than just remove trailing ones.
  • trim_start_regex: Removes leading regex matches. Use this to trim patterns from the beginning.