Dashboards & Visualizations

How can I extract the first 10 characters of token value in query?

wu_weidong
Path Finder

I have the following query statement:

index=users uin="$uin$" | timechart count by uin
The token "uin" came from another search on another index, and is of the format "1234567890abcde" or "1234567890". The "uin" field in the "users" index is only of the 10-digit format. I'm trying to search for a particular "uin" value in the "user" index based on the first 10 characters of whatever the "uin" token value is.

I've seen examples of using the substr function to get the first 10 values of the token value, but how can I use that as part of the search filter? The "user" index is quite big, so I would like to first filter for the particular "uin" before more processing.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @wu_weidong,

Can you please try following search?

index=users [| makeresults | eval temp="$uin$",uin=substr(temp,0,10) | return uin] | timechart count by uin

Thanks

View solution in original post

kmaron
Motivator

you could create a new token that is the substring of the original and use the new token in your search.

      <change>
        <eval token="uin_short">substr($uin$,0,10)</eval>
      </change>

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @wu_weidong,

Can you please try following search?

index=users [| makeresults | eval temp="$uin$",uin=substr(temp,0,10) | return uin] | timechart count by uin

Thanks

wu_weidong
Path Finder

Thanks! This worked. If you want, you can move it to the Answer section so I can accept it as the answer?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @wu_weidong,
Please accept the answer.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...