https://community.splunk.com/t5/Getting-Data-In/Trim-a-zip-code-to-5-characters/m-p/24203#M96604 <P>if your zip codes are in a field called ZIP, that could be done by</P> <PRE><CODE>your base search | eval SHORT_ZIP = substr(ZIP, 1,5) | ... </CODE></PRE> <P>/K</P> Fri, 03 May 2013 20:40:28 GMT kristian_kolb 2013-05-03T20:40:28Z https://community.splunk.com/t5/Getting-Data-In/Trim-a-zip-code-to-5-characters/m-p/24202#M96603 <P>This has to be an easy answer...I am just not seeing it or it is just a warm Friday and my brain is asleep.</P> <P>I have a column of results with zip codes e.g.</P> <PRE><CODE>94101 94102 941031514 941321600 </CODE></PRE> <P>I want to cut out the last 4 characters (if they exist). So all the results are 5 characters only</P> Fri, 03 May 2013 20:34:32 GMT https://community.splunk.com/t5/Getting-Data-In/Trim-a-zip-code-to-5-characters/m-p/24202#M96603 ccsfdave 2013-05-03T20:34:32Z https://community.splunk.com/t5/Getting-Data-In/Trim-a-zip-code-to-5-characters/m-p/24203#M96604 <P>if your zip codes are in a field called ZIP, that could be done by</P> <PRE><CODE>your base search | eval SHORT_ZIP = substr(ZIP, 1,5) | ... </CODE></PRE> <P>/K</P> Fri, 03 May 2013 20:40:28 GMT https://community.splunk.com/t5/Getting-Data-In/Trim-a-zip-code-to-5-characters/m-p/24203#M96604 kristian_kolb 2013-05-03T20:40:28Z