splunk query with substring not working

super_edition — Thu, 08 Aug 2024 11:55:54 GMT

Hello Everyone,

I have written the splunk query to remove last 2 character from the string:

processingDuration = 102ms as 102 for the following log:

{ "timestamp": "2029-02-29 07:32:54.734", "level": "INFO", "thread": "54dd544ff", "logger": "my.logger", "message": { "logTimeStamp": "2029-02-29T07:32:54.734494726Z", "logType": "RESP", "statusCode": 200, "processingDuration": "102ms", "headers": { "Content-Type": [ "application/json" ] }, "tracers": { "correlation-id": [ "hfkjhwkj98342" ], "request-id": [ "53456345" ], "service-trace-id": [ "34234623456" ] } }, "context": "hello-service" }

my splunk query:

index=my_index | spath logger | search logger="my.logger" | spath "message.logType" | search "message.logType"=RESP | spath "message.tracers.correlation-id{}" | search "message.tracers.correlation-id{}"="hfkjhwkj98342" | eval myprocessTime = substr("message.processingDuration", 1, len("message.processingDuration")-2) | table "message.tracers.correlation-id{}" myprocessTime

the above query considers "message.processingDuration" as string itself and removes last 2 characters out of it.

I tried without double quotes also, it returned empty:

substr(message.processingDuration, 1, len(message.processingDuration)-2)

Appreciate your help on this.

Thanks in advance.

Re: splunk query with substring not working

richgalloway — Thu, 08 Aug 2024 12:27:59 GMT

A string in single quotes is treated by Splunk as a field name.

substr('message.processingDuration', 1, len('message.processingDuration')-2)

topic splunk query with substring not working in Splunk Search

splunk query with substring not working

Re: splunk query with substring not working