topic what is the use of substr in my macro? in Splunk Search https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315338#M94402 <P>I have defined a field extraction in a macro as below </P> <P>my_search | eval field_A="EventCode: " + EventCode + "; EventType: " + EventType + "; Message: " + substr(Message,1,100)<BR /> iseval = 0</P> <P>What is meant by that? could anyone explain please.</P> Tue, 29 Sep 2020 17:02:17 GMT pavanae 2020-09-29T17:02:17Z what is the use of substr in my macro? https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315338#M94402 <P>I have defined a field extraction in a macro as below </P> <P>my_search | eval field_A="EventCode: " + EventCode + "; EventType: " + EventType + "; Message: " + substr(Message,1,100)<BR /> iseval = 0</P> <P>What is meant by that? could anyone explain please.</P> Tue, 29 Sep 2020 17:02:17 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315338#M94402 pavanae 2020-09-29T17:02:17Z Re: what is the use of substr in my macro? https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315339#M94403 <PRE><CODE>substr(X,Y,Z) Returns a substring from X based on the starting position Y and the length Z. </CODE></PRE> <P>In the search above <CODE>substr</CODE> returns the first 100 characters of the <CODE>Message</CODE> field.</P> Thu, 30 Nov 2017 02:13:24 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315339#M94403 micahkemp 2017-11-30T02:13:24Z Re: what is the use of substr in my macro? https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315340#M94404 <P>The substr command grabs a section of text beginning at the first indicated index number Until the number of characters is reached (second number indicated). In your example, it is grabbing the first 100 characters of the field Message. <BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/TextFunctions">http://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/TextFunctions</A></P> Thu, 30 Nov 2017 02:14:55 GMT https://community.splunk.com/t5/Splunk-Search/what-is-the-use-of-substr-in-my-macro/m-p/315340#M94404 cmerriman 2017-11-30T02:14:55Z