Skip to main content
The trim_regex function removes all leading and trailing matches of a regular expression pattern from a string. Use this function to clean strings from both ends using pattern matching, normalize data with complex prefix/suffix patterns, or prepare strings for consistent analysis.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use multiple rex commands for bidirectional trimming. APL’s trim_regex handles both ends in one operation.
| rex field=field mode=sed "s/^pattern//g"
| rex field=field mode=sed "s/pattern$//g"
In ANSI SQL, bidirectional regex trimming requires nested functions. APL’s trim_regex provides a single-function solution.
SELECT REGEXP_REPLACE(REGEXP_REPLACE(field, '^pattern', ''), 'pattern$', '') AS cleaned FROM logs;

Usage

Syntax

trim_regex(regex, text)

Parameters

NameTypeRequiredDescription
regexstringYesThe regular expression pattern to remove from both ends.
textstringYesThe source string to trim.

Returns

Returns the source string with leading and trailing regex matches removed.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Remove leading and trailing slashes or special characters from URIs.Query
['sample-http-logs']
| extend cleaned_uri = trim_regex('[/\\\\]+', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
cleaned_urimethodrequest_count
api/usersGET2341
api/ordersPOST1987
This query removes leading and trailing slashes from URIs, normalizing paths for consistent endpoint analysis.
  • trim: Removes leading and trailing characters. Use this for simple character-based trimming without regex.
  • trim_start_regex: Removes leading regex matches. Use this for pattern trimming only from the start.
  • trim_end_regex: Removes trailing regex matches. Use this for pattern trimming only from the end.
  • replace_regex: Replaces regex matches. Use this when you need to replace patterns anywhere, not just trim ends.