Axiom
Overview

trim_end_regex

Usage#

Syntax#

trim_end_regex(regex, text)

Parameters#

Name Type Required Description
regex string Yes The regular expression pattern to remove from the end.
text string Yes The source string to trim.

Returns#

Returns the source string with trailing regex matches removed.

Use case examples#

Remove trailing numeric suffixes or version numbers from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end_regex('[0-9]+$', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri method request_count
/api/users/ GET 2341
/api/orders/ POST 1987

This query removes trailing numeric IDs from URIs, allowing aggregation by endpoint type rather than individual resources.

Remove version suffixes from service names using regex patterns.

Query

['otel-demo-traces']
| extend cleaned_service = trim_end_regex('-v[0-9]+[.][0-9]+$', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service span_count
frontend 4532
checkout 3421
cart 2987

This query removes version number suffixes like '-v1.0' or '-v2.3' from service names, enabling cross-version analysis.

Remove trailing hexadecimal session tokens or identifiers from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_end_regex('[a-f0-9]{8,}$', uri)
| summarize attempts = count() by cleaned_uri, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_uri status failed_attempts
/api/session/ 401 234
/admin/token/ 403 156

This query removes trailing hexadecimal tokens from URIs, helping identify which endpoints are targeted in authentication attempts without session-specific noise.

  • trim_end: Removes trailing characters. Use this for simple character-based trimming without regex.
  • trim_regex: Removes both leading and trailing regex matches. Use this for bidirectional pattern trimming.
  • replace_regex: Replaces regex matches. Use this when you need to replace patterns rather than just remove trailing ones.
  • trim_start_regex: Removes leading regex matches. Use this to trim patterns from the beginning.

Other query languages#

Splunk SPL users

In Splunk SPL, you use rex with mode=sed for pattern-based trimming. APL's trim_end_regex provides a more direct approach.

Splunk example

| rex field=field mode=sed "s/pattern$//g"

APL equivalent

['sample-http-logs']
| extend cleaned = trim_end_regex('pattern', field)
ANSI SQL users

In ANSI SQL, regex-based trimming requires database-specific functions. APL's trim_end_regex provides standardized pattern-based trimming.

SQL example

SELECT REGEXP_REPLACE(field, 'pattern$', '') AS cleaned FROM logs;

APL equivalent

['sample-http-logs']
| extend cleaned = trim_end_regex('pattern', field)

Updated

Was this page helpful?