https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23218#M177455 <P>As a general tip regarding your search - you don't need the two <CODE>table</CODE> command you have in there.</P> <P>You can get rid of the country values starting with a digit by adding a <CODE>where</CODE> command after your initial search command...</P> <PRE><CODE>source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ... </CODE></PRE> Fri, 03 May 2013 06:57:20 GMT Ayn 2013-05-03T06:57:20Z https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23217#M177454 <P>Hi this my search results <BR /> COUNTRY avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER)<BR /> 1 268647320 462.000000<BR /> 2 268647324 404.000000<BR /> 3 268647325 483.000000<BR /> 4 268713740 90.000000<BR /> 5 268755211 95.000000<BR /> 6 268755212 81.000000<BR /> 7 268910904 47.000000<BR /> 8 ALBANIA 78.885057<BR /> 9 ALGERIA 162.192308<BR /> 10 ANDORRA 72.083333<BR /> 11 ANGOLA 87.625000<BR /> 12 ARGENTINA 131.596965<BR /> 13 ARMENIA 124.333333<BR /> 14 AUSTRALIA 119.199497<BR /> 15 AUSTRIA 140.973917<BR /> 16 AZERBAIJAN 136.800000<BR /> 17 BAHAMAS 200.375000<BR /> 18 BAHRAIN 102.406360</P> <P>I want only countries to be displayed,i want to eliminate first numbers from COUNTRY field.</P> <P>My search query is<BR /> source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | table CUS_OBJID,COUNTRY,CITY,ORDER_CREATED_DATE,ORDER_END_DATE | eval j2=ORDER_END_DATE | eval j1=ORDER_CREATED_DATE | eval d1=strptime(j1,"%d-%b-%y") |eval d2=strptime(j2,"%d-%b-%y") | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER = (d2-d1)/86400 | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER=round(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER,2) |table COUNTRY,CITY,TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER | stats avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER) by COUNTRY </P> <P>Please help me</P> Mon, 28 Sep 2020 13:49:22 GMT https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23217#M177454 ncbshiva 2020-09-28T13:49:22Z https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23218#M177455 <P>As a general tip regarding your search - you don't need the two <CODE>table</CODE> command you have in there.</P> <P>You can get rid of the country values starting with a digit by adding a <CODE>where</CODE> command after your initial search command...</P> <PRE><CODE>source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ... </CODE></PRE> Fri, 03 May 2013 06:57:20 GMT https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23218#M177455 Ayn 2013-05-03T06:57:20Z https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23219#M177456 <P>thanks.................</P> Fri, 03 May 2013 08:46:55 GMT https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23219#M177456 ncbshiva 2013-05-03T08:46:55Z https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23220#M177457 <P>No problem. Please mark my answer as accepted if it solved your problem.</P> Fri, 03 May 2013 09:02:41 GMT https://community.splunk.com/t5/Splunk-Search/To-eliminate-numbers/m-p/23220#M177457 Ayn 2013-05-03T09:02:41Z