Only Show certain values

[msarkaus]

Any suggestions would be appreciated.

In the first row I would like to show only the first 34 characters and in the second row the first list 39 characters.

msarkaus_0-1720724943510.png

I figured out how to only show a certain number of characters for all rows, but not individual rows.

| eval msgTxt=substr(msgTxt, 1, 49)
| stats count by msgTxt

[gcusello]

Hi @msarkaus ,

if the condition is fixed (SUCCEDED 34 chars and FAILED 39 chars), you could use an if condition in the eval command:

<your_search>
| eval msgTxt=if(match(msgTxt,"SUCCEDED"), substr(msgTxt, 1, 34), substr(msgTxt, 1, 39)
| stats count by msgTxt

Ciao.

Giuseppe

[ITWhisperer]

You need to be able to identify which is the first event and which is the second. You can do this like so:

| streamstats count as row

[PickleRick]

You want to show 34 characters because the event is first or because of some other reason and the event just happens to be first?