topic Re: How to remove part of my value to create a new value? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346158#M102539 <P>@micahkemp 's answer is great, you could also try <CODE>|eval newCreatedTime =mvindex(split(created_time,"."),0)</CODE> I only mention this in case you ever need to split a field that isn't numeric. <A href="http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/MultivalueEvalFunctions">http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/MultivalueEvalFunctions</A></P> Mon, 05 Feb 2018 16:56:35 GMT cmerriman 2018-02-05T16:56:35Z How to remove part of my value to create a new value? https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346156#M102537 <P>Hi guys, </P> <P>My goal is to remove part of my value to create a new value. </P> <P>For example, I have a field called <CODE>created_time = 1517789420.357994</CODE>. Does anyone know a way of getting <CODE>newCreatedTime = 1517789420</CODE>?</P> <P>I basically just want the .* to go away! </P> <P>Any help would be appreciated. </P> <P>Cheers!</P> Mon, 05 Feb 2018 16:46:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346156#M102537 Robbie1194 2018-02-05T16:46:48Z Re: How to remove part of my value to create a new value? https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346157#M102538 <PRE><CODE>| eval newCreatedTime=floor(created_time) </CODE></PRE> Mon, 05 Feb 2018 16:51:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346157#M102538 micahkemp 2018-02-05T16:51:09Z Re: How to remove part of my value to create a new value? https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346158#M102539 <P>@micahkemp 's answer is great, you could also try <CODE>|eval newCreatedTime =mvindex(split(created_time,"."),0)</CODE> I only mention this in case you ever need to split a field that isn't numeric. <A href="http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/MultivalueEvalFunctions">http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/MultivalueEvalFunctions</A></P> Mon, 05 Feb 2018 16:56:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-part-of-my-value-to-create-a-new-value/m-p/346158#M102539 cmerriman 2018-02-05T16:56:35Z