https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490562#M194150 <P>I am trying to solve a query and I came across a time modifier with len() function. I did not understand the behavior.</P> Thu, 23 Jan 2020 09:40:44 GMT yasaswinipotta 2020-01-23T09:40:44Z https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490562#M194150 <P>I am trying to solve a query and I came across a time modifier with len() function. I did not understand the behavior.</P> Thu, 23 Jan 2020 09:40:44 GMT https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490562#M194150 yasaswinipotta 2020-01-23T09:40:44Z https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490563#M194151 <P>@yasaswinipotta </P> <P>Can you please share more information of your issue? How you are using <CODE>len()</CODE> with time modifier and what is the purpose/requirement OR your sample search? </P> Thu, 23 Jan 2020 13:07:04 GMT https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490563#M194151 kamlesh_vaghela 2020-01-23T13:07:04Z https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490564#M194152 <P>I think the short answer is whatever you have come across is wrong.</P> <P><CODE>|eval result=len(-5d@d)</CODE> will not execute.<BR /> However<BR /> <CODE>|eval result=len("-5d@d")</CODE> will execute and return the value of 5 (as there are 5 characters in that string)</P> <P>Can you share a link to the material?</P> Thu, 23 Jan 2020 13:35:26 GMT https://community.splunk.com/t5/Splunk-Search/len-5d-d/m-p/490564#M194152 nickhills 2020-01-23T13:35:26Z