https://community.splunk.com/t5/Splunk-Search/Need-string-minus-last-2-characters/m-p/91308#M23482 <P>I am trying to set a field to the value of a string without the last 2 digits. For example:</P> <P>Hotel=297654 from 29765423 <BR /> Hotel=36345 from 3624502</P> <P>I tried rtrim but docs say you must know the exact string you're removing, mine are different every time. I also tried substr but the length is not constant from 1st character and using -2 like substr(Field, -2) returns the last 2 characters...the part I want to throw away.</P> <P>Was trying something like rtrim(Field,substr(Field,-2) but can't get that to work.</P> <P>Suggestions? - THANKS</P> Thu, 13 Oct 2011 17:07:19 GMT rachelneal 2011-10-13T17:07:19Z https://community.splunk.com/t5/Splunk-Search/Need-string-minus-last-2-characters/m-p/91308#M23482 <P>I am trying to set a field to the value of a string without the last 2 digits. For example:</P> <P>Hotel=297654 from 29765423 <BR /> Hotel=36345 from 3624502</P> <P>I tried rtrim but docs say you must know the exact string you're removing, mine are different every time. I also tried substr but the length is not constant from 1st character and using -2 like substr(Field, -2) returns the last 2 characters...the part I want to throw away.</P> <P>Was trying something like rtrim(Field,substr(Field,-2) but can't get that to work.</P> <P>Suggestions? - THANKS</P> Thu, 13 Oct 2011 17:07:19 GMT https://community.splunk.com/t5/Splunk-Search/Need-string-minus-last-2-characters/m-p/91308#M23482 rachelneal 2011-10-13T17:07:19Z https://community.splunk.com/t5/Splunk-Search/Need-string-minus-last-2-characters/m-p/91309#M23483 <P>This may do it:</P> <P><CODE>&lt;your_search_here&gt; | eval myfield = substr(myfield, 1, len(myfield)-2)</CODE></P> <P>d.</P> <P>-<BR /> <CODE>please upvote if you find this answer useful</CODE> </P> Thu, 13 Oct 2011 17:44:58 GMT https://community.splunk.com/t5/Splunk-Search/Need-string-minus-last-2-characters/m-p/91309#M23483 _d_ 2011-10-13T17:44:58Z