topic Re: Truncate the log description after n words. in Getting Data In

Truncate the log description after n words.

RSS_STT — Mon, 05 Feb 2024 06:59:57 GMT

How can i Truncate the log description after 20 words in splunk and store in new field.

Re: Truncate the log description after n words.

batabay — Mon, 05 Feb 2024 07:24:23 GMT

Hello,

You can try this.

| makeresults | eval test = "somestring1somestring2somestring3" | eval new_field = if(len(test)>20,substr(test,20,len(test)),null())

Re: Truncate the log description after n words.

RSS_STT — Mon, 05 Feb 2024 07:40:44 GMT

i need to truncate the string based on word count, not based on character count.

it should save truncated string (start to 25 words) into new fields.

Current which you have provided doing on character count basis.

Re: Truncate the log description after n words.

batabay — Mon, 05 Feb 2024 07:51:41 GMT

Okay Than, We can use regex. Can you try this ?

| makeresults | eval description = "somestring1 somestring2 somestring3 somestring4 somestring5" | rex field=description "(?<new_field>^\S+(?:\S+\s+){20}\S+)" | eval new_field_replaced = replace(description,new_field,"") | eval description = replace(description,new_field,"")

Re: Truncate the log description after n words.

RSS_STT — Mon, 05 Feb 2024 08:12:05 GMT

Looking good. But this regex not handling the special character and digit. for example date 05/0/:2024 10:11:56.000 EST

Re: Truncate the log description after n words.

batabay — Mon, 05 Feb 2024 08:21:23 GMT

I couldn't exactly understand what you're not doing with the timestamp. There are many different ways to extract the timestamp from the log. If you want to capture this field additionally, you can use \S+\s\S+.

There is example regex;

^\S+\s+\S+\s\w+\s(\S+(?:\S+\s+){1}\S+)