https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30278#M178005 <P>Fields are case-sensitive, search is not. Try:</P> <PRE><CODE>"corid=" | eval length=len(corid) | fillnull value=0 length | fields + length </CODE></PRE> Thu, 19 Apr 2012 03:38:44 GMT araitz 2012-04-19T03:38:44Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30277#M178004 <P>Hi,</P> <P>I am trying to extract a corId from the log and find the length of the corId.<BR /> when searching am able to successfully locate the Cor Id however when evaluating its lengths, I am not able to succeed.<BR /> I used the search query as below</P> <P>corId | eval length=len(corId)</P> <P>the actual log file is as below:<BR /> ExecuteThread: '10' for queue: 'weblogic.kernel.Default (self-tuning)'&gt; &lt;<ANONYMOUS>&gt; &lt;&gt; &lt;&gt; &lt;1334795010998&gt; <BEA-000000> &lt; [RouteNodeAccountContactdetails, null, null, REQUEST] Header in request node of getAccountContactDetails Service: <HEADER S="http://schemas.xmlsoap.org/soap/envelope/"><BR /> <WSCORIDSOAPHEADER corid="C7FB61810A75D70801C64ED865FB85DA,1:2:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:1:7:336,0,0,au11qsn01atels2|WebLogic|wl_mp_ep_0101|WebServices|Client|http_//telstra.com/ep/service/user/2009/1|getAccountContactDetails,2,AgAAALJIQgAAAAFGAAAAAQAAABFqYXZhLnV0aWwuSGFzaE1hcAAAAAJIQgAAAAJGAAAAAgAAABBqYXZhLmxhbmcuU3RyaW5nAA9DYWxsZXJUaW1lc3RhbXBIQgAAAANFAAAAAgANMTMzNDc5NTAxMDgyNEhCAAAABEUAAAACAApUeG5UcmFjZUlkSEIAAAAFRQAAAAIAIEM3RkI2Qzk0MEE3NUQ3MDgwMUM2NEVEOEI3Q0JBNEZC" xmlns="http://www.wilytech.com/"></WSCORIDSOAPHEADER><BR /> <MESSAGEID WSA="http://schemas.xmlsoap.org/ws/2004/08/addressing">123<A href="https://answers.splunk.comwsa:MessageID">/wsa:MessageID</A><BR /> <FROM WSA="http://schemas.xmlsoap.org/ws/2004/08/addressing"><BR /> <ADDRESS>portal</ADDRESS><BR /> <REFERENCEPARAMETERS><BR /> <WEBHOSTIPADDRESS>10.117.215.8</WEBHOSTIPADDRESS><BR /> <SESSIONID>123</SESSIONID><BR /> </REFERENCEPARAMETERS><BR /> <A href="https://answers.splunk.comwsa:From">/wsa:From</A><BR /> <USERID>E8813354426S36</USERID><BR /> <A href="https://answers.splunk.comS:Header">/S:Header</A>&gt; </FROM></MESSAGEID></HEADER></BEA-000000></ANONYMOUS></P> <H4>&lt;19/04/2012 10:23:25 AM EST&gt; <ERROR> <ALSB logging=""> <AU11QAPBQ0TELS2> <WL_MP_OSB_0102> &lt;[ACTIVE] ExecuteThread: '30' for queue: 'weblogic.kernel.Default (self-tuning)'&gt; &lt;<ANONYMOUS>&gt; &lt;&gt; &lt;&gt; &lt;1334795005278&gt; <BEA-000000> &lt; [RouteNodeUserDetails, null, null, REQUEST] Header in request node of getUsersDetails Service: <HEADER S="http://schemas.xmlsoap.org/soap/envelope/"></HEADER></BEA-000000></ANONYMOUS></WL_MP_OSB_0102></AU11QAPBQ0TELS2></ALSB></ERROR></H4> <P><WSCORIDSOAPHEADER corid="C7FB6C980A75D70801C64ED861D0D6F5,1:1,0,0,au11qsn01atels2|WebLogic|wl_mp_ep_0101|WebServices|Client|http_//telstra.com/ep/service/user/2009/1|getUserDetails,2,AgAAALJIQgAAAAFGAAAAAQAAABFqYXZhLnV0aWwuSGFzaE1hcAAAAAJIQgAAAAJGAAAAAgAAABBqYXZhLmxhbmcuU3RyaW5nAA9DYWxsZXJUaW1lc3RhbXBIQgAAAANFAAAAAgANMTMzNDc5NTAwNTA4N0hCAAAABEUAAAACAApUeG5UcmFjZUlkSEIAAAAFRQAAAAIAIEM3RkI2OUUwMEE3NUQ3MDgwMUM2NEVEODlCQjBGRUYy" xmlns="http://www.wilytech.com/"></WSCORIDSOAPHEADER><BR /> <MESSAGEID WSA="http://schemas.xmlsoap.org/ws/2004/08/addressing">123<A href="https://answers.splunk.comwsa:MessageID">/wsa:MessageID</A><BR /> <FROM WSA="http://schemas.xmlsoap.org/ws/2004/08/addressing"></FROM></MESSAGEID></P> <P>please help.</P> Thu, 19 Apr 2012 02:49:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30277#M178004 splunk_jerome 2012-04-19T02:49:22Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30278#M178005 <P>Fields are case-sensitive, search is not. Try:</P> <PRE><CODE>"corid=" | eval length=len(corid) | fillnull value=0 length | fields + length </CODE></PRE> Thu, 19 Apr 2012 03:38:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30278#M178005 araitz 2012-04-19T03:38:44Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30279#M178006 <P>Have you extracted the corId field yet with a field extraction? </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsatsearchtime</A></P> <P>Once you have the field extracted, eval with the len function is probably the way to go.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <P>From there you can explore doing simple stats around this field... </P> <P><CODE>corId | eval length=len(corId) | stats count by length</CODE></P> <P><CODE>corId | eval length=len(corId) | stats max(length) min(length) by User</CODE></P> <P>Or finding searches with especially long ones..</P> <P><CODE>* | eval length=len(corId) | where length&gt;40</CODE></P> Thu, 19 Apr 2012 03:42:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30279#M178006 sideview 2012-04-19T03:42:11Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30280#M178007 <P><CODE>* | eval length=len(corId) | where length&gt;40</CODE> - perfect thank you!</P> Mon, 07 Mar 2016 16:36:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-length-of-the-string-using-len-string-function/m-p/30280#M178007 jakeblack 2016-03-07T16:36:33Z