topic Re: Truncating results in Getting Data In

Truncating results

lemikg — Fri, 08 Feb 2013 09:39:03 GMT

Hi there,

I am looking for a way to truncate the characters of my results.

I am doing a simple search like sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND

In the results I have many similar names like watchdog01, watchdog02, watchdog03 and so on.

Those I want to truncate to -2 characters in order to display only "watchdog"

Any help would be much appreciated.

Best regards
Mike

Re: Truncating results

martin_mueller — Fri, 08 Feb 2013 10:01:44 GMT

If you want to keep a number of characters at the start or end of a field you can do something like this:

| gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

Re: Truncating results

lemikg — Fri, 08 Feb 2013 10:53:09 GMT

Hi Martin, thanks for the quick response.

sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND | gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

Doesn't seem to work in my search. It says

Error in 'gentimes' command: This command must be the first command of a search.

I am not familiar with the "gentime-command" but the search reference states that it is useful to generate time range results.

Is there another approach?

Re: Truncating results

martin_mueller — Fri, 08 Feb 2013 11:01:22 GMT

gentimes just generates sample data for me. Put the entire query into splunk on its own, nothing before it - then understand what it does, and apply to your problem 🙂

Re: Truncating results

lemikg — Fri, 08 Feb 2013 11:30:02 GMT

i got you now ^^ thanks.

Re: Truncating results

lemikg — Fri, 08 Feb 2013 12:07:28 GMT

Just out of curiousity, what command should I use if I only want to have characters (a-z) returned?

Re: Truncating results

martin_mueller — Fri, 08 Feb 2013 12:32:00 GMT

Just change the regular expression, this matches everything not lowercase a-z and replaces it with nothing:

| gentimes start=-1 increment=5m | eval test = replace(starthuman, "[^a-z]", "")