https://community.splunk.com/t5/Splunk-Search/Substring-only-the-displayed-data/m-p/410763#M167213 <P>| eval Message = substr(Message 1,100) </P> Sun, 28 Oct 2018 12:27:22 GMT valiquet 2018-10-28T12:27:22Z https://community.splunk.com/t5/Splunk-Search/Substring-only-the-displayed-data/m-p/410762#M167212 <P>The goal here is to let the search filter on the full values but only return a portion (substring) of the "Message" field to the table in the below query. </P> <P>Often we will have an idea of the event based on the first 100 characters but I need the full messages to be evaluated as truncating them at a search level might cause undesired results. </P> <PRE><CODE>index=db_apps_digital host=abc* OR host=abc* NOT host=abc NOT host=zxc | spath "Properties.Application" | search "Properties.Application"="app01" OR "Properties.Application"="app02" OR "Properties.Application"="app03" | eval LastEventDateTime=strftime(strptime(LastEventDateTime,"%Y-%m-%dT%H:%M:%S.%N%z") ,"%Y-%m-%d %H:%M:%S") | stats count latest(Timestamp) as LastEventDateTime by Properties.Message, Level, Properties.Application | sort -count, Level | head 100 | rename Properties.Application as Application, Properties.Message as Message </CODE></PRE> Mon, 08 Oct 2018 06:28:12 GMT https://community.splunk.com/t5/Splunk-Search/Substring-only-the-displayed-data/m-p/410762#M167212 rossboss1989 2018-10-08T06:28:12Z https://community.splunk.com/t5/Splunk-Search/Substring-only-the-displayed-data/m-p/410763#M167213 <P>| eval Message = substr(Message 1,100) </P> Sun, 28 Oct 2018 12:27:22 GMT https://community.splunk.com/t5/Splunk-Search/Substring-only-the-displayed-data/m-p/410763#M167213 valiquet 2018-10-28T12:27:22Z