https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267446#M80460 <P>Try with quotes:</P> <PRE><CODE>baseSearch | eval id = substr("detail.id",2,7)| table id </CODE></PRE> Fri, 01 Apr 2016 09:39:56 GMT javiergn 2016-04-01T09:39:56Z https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267445#M80459 <P>I am doing a substr and want to see that in a table, however it just gives no results</P> <P>baseSearch | eval id = substr(detail.id,2,7)| table id</P> <P>I would expect to see a table of id's that have been substringed, however I get no results found?</P> Fri, 01 Apr 2016 09:37:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267445#M80459 dan_pudwell 2016-04-01T09:37:30Z https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267446#M80460 <P>Try with quotes:</P> <PRE><CODE>baseSearch | eval id = substr("detail.id",2,7)| table id </CODE></PRE> Fri, 01 Apr 2016 09:39:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267446#M80460 javiergn 2016-04-01T09:39:56Z https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267447#M80461 <P>I just figured this out and went to add my own answer!<BR /> single quotes work as well</P> Fri, 01 Apr 2016 09:46:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267447#M80461 dan_pudwell 2016-04-01T09:46:38Z https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267448#M80462 <P>So will dollar-signs.</P> Fri, 01 Apr 2016 14:14:51 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267448#M80462 woodcock 2016-04-01T14:14:51Z https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267449#M80463 <P>Hi,<BR /> I have DB field which has value like -<BR /> DB = arn:aws:rds:eu-west-1:354706231380:db:we1abcdeslfwtya<BR /> I want to print we1abcdeslfwtya<BR /> And below is my query -<BR /> | rename results{}.total_amortized_cost as Total_amor , results{}.resource_identifier as DB | eval n=substr(DB,15) | table DB , n<BR /> However, I get the n column in table as blank. I dont know whats wrong happening here. I tried with double quotes ( " ) and single quotes ( ' ) both for DB and it doesn't work. Like substr("DB",15)<BR /> Can someone help please.<BR /> Thanks in advance<BR /> Regards,<BR /> Sumeet</P> Tue, 29 Sep 2020 23:44:41 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-a-substr/m-p/267449#M80463 sumeet20rani 2020-09-29T23:44:41Z