I have a field called org_name in the data as below
Org_name="davidcareerhome"
Org_name ="Ethanfurniture"
I want to limit the Org_name only for the first three bytes as below
Org_name="dav"
Org_name="Eth"
Can someone help me with this and how to do make this change in props.conf and the regex for the same ?
Use the substr function.
... | eval Org_name=substr(Org_name, 1, 3)