Axiom
Overview

trim_regex

Usage#

Syntax#

trim_regex(regex, text)

Parameters#

Name Type Required Description
regex string Yes The regular expression pattern to remove from both ends.
text string Yes The source string to trim.

Returns#

Returns the source string with leading and trailing regex matches removed.

Use case examples#

Remove leading and trailing slashes or special characters from URIs.

Query

['sample-http-logs']
| extend cleaned_uri = trim_regex('[/]+', uri)
| summarize request_count = count() by cleaned_uri, method
| sort by request_count desc
| limit 10

Run in Playground

Output

cleaned_uri method request_count
api/users GET 2341
api/orders POST 1987

This query removes leading and trailing slashes from URIs, normalizing paths for consistent endpoint analysis.

Clean service names by removing environment prefixes and version suffixes.

Query

['otel-demo-traces']
| extend cleaned_service = trim_regex('(^(dev|prod|staging)-)|(-v[0-9.]+$)', ['service.name'])
| summarize span_count = count() by cleaned_service
| sort by span_count desc
| limit 10

Run in Playground

Output

cleaned_service span_count
frontend 4532
checkout 3421
cart 2987

This query removes both environment prefixes and version suffixes from service names, enabling aggregation across all environments and versions.

Remove leading/trailing whitespace and special characters from user identifiers.

Query

['sample-http-logs']
| extend cleaned_id = trim_regex('[^a-zA-Z0-9_]+', id)
| summarize attempts = count() by cleaned_id, status
| sort by attempts desc
| limit 10

Run in Playground

Output

cleaned_id status attempts
user123 401 45
admin 403 32

This query cleans user IDs by removing whitespace and special characters from both ends, ensuring accurate counting when identifiers have formatting inconsistencies.

  • trim: Removes leading and trailing characters. Use this for simple character-based trimming without regex.
  • trim_start_regex: Removes leading regex matches. Use this for pattern trimming only from the start.
  • trim_end_regex: Removes trailing regex matches. Use this for pattern trimming only from the end.
  • replace_regex: Replaces regex matches. Use this when you need to replace patterns anywhere, not just trim ends.

Other query languages#

Splunk SPL users

In Splunk SPL, you use multiple rex commands for bidirectional trimming. APL's trim_regex handles both ends in one operation.

Splunk example

| rex field=field mode=sed "s/^pattern//g"
| rex field=field mode=sed "s/pattern$//g"

APL equivalent

['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)
ANSI SQL users

In ANSI SQL, bidirectional regex trimming requires nested functions. APL's trim_regex provides a single-function solution.

SQL example

SELECT REGEXP_REPLACE(REGEXP_REPLACE(field, '^pattern', ''), 'pattern$', '') AS cleaned FROM logs;

APL equivalent

['sample-http-logs']
| extend cleaned = trim_regex('pattern', field)

Updated

Was this page helpful?