https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174779#M50158 <P>try this</P> <P>| eval newvariable=substr(newvariable,1,5)</P> Wed, 05 Mar 2014 16:53:00 GMT somesoni2 2014-03-05T16:53:00Z https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174777#M50156 <P>I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed. </P> <P>In Python I would do something like this:</P> <P>newvariable = 'blahblahblah'<BR /> newvariable[0:4]<BR /> blahb</P> Wed, 05 Mar 2014 14:38:13 GMT https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174777#M50156 ezajac 2014-03-05T14:38:13Z https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174778#M50157 <P>There are many examples here:</P> <P><A href="http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf">http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf</A></P> <P>I believe what you are looking for is "substr"</P> Wed, 05 Mar 2014 14:42:51 GMT https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174778#M50157 aelliott 2014-03-05T14:42:51Z https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174779#M50158 <P>try this</P> <P>| eval newvariable=substr(newvariable,1,5)</P> Wed, 05 Mar 2014 16:53:00 GMT https://community.splunk.com/t5/Splunk-Search/Eval-String-Function/m-p/174779#M50158 somesoni2 2014-03-05T16:53:00Z