Getting Data In

How to truncate a field or limit a field value

ethanthomas
Explorer

I have  a field called org_name in the data as below 

Org_name="davidcareerhome"

Org_name ="Ethanfurniture"

I want to limit the Org_name only for the first three bytes as below 

Org_name="dav"

Org_name="Eth"

Can someone help me with this and how to do make this change in props.conf and the regex for the same ?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the substr function.

... | eval Org_name=substr(Org_name, 1, 3)

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!