topic How to trim column in table? in Splunk Search

How to trim column in table?

naujla85 — Mon, 15 May 2023 13:49:26 GMT

Hello,

I am running the following query.

index=sys_tools_ecc-appd application_name=CAPRI-1130 | table * | search source=business_transactions business_transactions.metricName="*Average Response Time (ms)*" | timechart avg(business_transactions.metricValues{}.value) by business_transactions.metricPath

The business_transactions.metricPath names are all too long example below:

1. Business Transaction Performance|Business Transactions|APP|/dbq/ecrud|Average Response Time (ms)

2. Business Transaction Performance|Business Transactions|APP|/dbq/BTSXDRRequest_PortTypeWS|Average Response Time (ms)

Need to trim them from both side. I need to remove "Business Transaction Performance|Business Transactions" from the front and "|Average Response Time (ms)" from the back before displaying them on column.

Re: How to trim column in table?

ITWhisperer — Mon, 15 May 2023 14:38:31 GMT

Try something like this before the timechart command

| eval business_transactions.metricPath=replace(business_transactions.metricPath,"Business Transaction Performance\|Business Transactions\"","") | eval business_transactions.metricPath=replace(business_transactions.metricPath,"\|Average Response Time (ms)","")

Re: How to trim column in table?

naujla85 — Mon, 15 May 2023 17:02:44 GMT

its showing me null value.

How to trim column in table?

richgalloway — Mon, 15 May 2023 17:07:57 GMT

Use an AS clause in the timechart command to specify a shorter name for the average value field.

| timechart avg(business_transactions.metricValues{}.value) as avgMetricValue by business_transactions.metricPath

Or use rename

| rename "Business Transaction Performance|Business Transactions|*|Average Response Time (ms)" as *

Re: How to trim column in table?

naujla85 — Mon, 15 May 2023 18:03:43 GMT

second solution worked for me thank you!!!!!