topic Re: find max length where field name is firstName_1,firstName_2... in Splunk Search

find max length where field name is firstName_1,firstName_2...

dummy1281 — Tue, 29 Sep 2020 20:55:44 GMT

My splunk entry is firstName_1="Tom" firstName_2="Jerry" firstName_3="Tom1" firstName_4="Jerry1"

I would like to find max length of firstName. Answer for above entry should be 6 as firstName_4 length is Jerry1 (6)

Tried | table firstName_* but getting all the values in table and to find max length, I need to find the length manually.

Tried | eval len (firstName_*) but getting error.

Can you please help me with this. Thanks

Re: find max length where field name is firstName_1,firstName_2...

richgalloway — Thu, 16 Aug 2018 14:32:19 GMT

Use foreach to process each firstName_* field.

... | eval maxLen=0 | foreach firstName_* [eval maxLen=if(len(<<FIELD>>) > maxLen, len(<<FIELD>>), maxLen)] | ...

Re: find max length where field name is firstName_1,firstName_2...

493669 — Thu, 16 Aug 2018 14:33:30 GMT

I hope this will work:

  ...| eval Max=0
 | foreach firstName_*
     [eval Max=case(Max>=len('<<FIELD>>'),Max,true(),len('<<FIELD>>'))]

Converted to comment since rich answer is more correct

Re: find max length where field name is firstName_1,firstName_2...

richgalloway — Thu, 16 Aug 2018 15:54:37 GMT

I wouldn't say it's more correct. Just different.

Re: find max length where field name is firstName_1,firstName_2...

dummy1281 — Mon, 20 Aug 2018 13:03:41 GMT

Thank you for your reply. When I try

index=x | eval maxLen=0 | foreach firstName_* [eval maxLen=if(len(<>) > maxLen, len(<>), maxLen)]

I am getting result as same for index=x

but not the max length for firstName_*

I'm really not sure what I'm missing. Can you please help.

Re: find max length where field name is firstName_1,firstName_2...

kamlesh_vaghela — Mon, 20 Aug 2018 13:34:29 GMT

@dummy1281

It should work.

Can you please try this?

index=x 
| eval maxLen=0  
| foreach firstName_* 
    [ eval maxLen=case(maxLen>=len('<<FIELD>>'),maxLen,true(),len('<<FIELD>>'))] 
| table firstName* maxLen

Sample search:

| makeresults 
| eval maxLen=0, firstName_1="Tom",firstName_2="Jerry",firstName_3="Tom1",firstName_4="Jerry1llll" 
| foreach firstName_* 
    [ eval maxLen=case(maxLen>=len('<<FIELD>>'),maxLen,true(),len('<<FIELD>>'))] 
| table firstName* maxLen

Thanks

Re: find max length where field name is firstName_1,firstName_2...

dummy1281 — Wed, 22 Aug 2018 13:13:58 GMT

Thanks Kamlesh. It works