Getting Data In

How to truncate a field or limit a field value

ethanthomas
Path Finder

I have  a field called org_name in the data as below 

Org_name="davidcareerhome"

Org_name ="Ethanfurniture"

I want to limit the Org_name only for the first three bytes as below 

Org_name="dav"

Org_name="Eth"

Can someone help me with this and how to do make this change in props.conf and the regex for the same ?

Labels (1)

richgalloway
SplunkTrust
SplunkTrust

Use the substr function.

... | eval Org_name=substr(Org_name, 1, 3)

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...