topic Re: How can I exclude a value if it is equal or less than the number of char? in Splunk Search

How can I exclude a value if it is equal or less than the number of char?

innoce — Thu, 07 Apr 2022 09:42:39 GMT

I need to exclude the field values if it is less than or equal to 8 characters. For eg: In the field abc, I have the below values in which I need to exclude only (browsers, files, members) 'coz these has equal to or less than 8 characters. And I need to have the other values

abc:
browsers
files
attachment
members
auto-saved
splunk-answers
discussions

Can someone help me on this, please?

Re: How can I exclude a value if it is equal or less than the number of char?

ITWhisperer — Thu, 07 Apr 2022 09:55:10 GMT

| regex abc=".{9}"

Re: How can I exclude a value if it is equal or less than the number of char?

gcusello — Thu, 07 Apr 2022 10:03:51 GMT

Hi @innoce,

you can use eval len, something like this sample:

| makeresults | eval ppp="12345678" | eval check=if(len(ppp)>8,"OK","NOK") | table check

Ciao.

Giuseppe