Truncate the log description after n words.

[RSS_STT]

How can i Truncate the log description after 20 words in splunk and store in new field.

[batabay]

Hello,

You can try this.

| makeresults 
| eval test = "somestring1somestring2somestring3" 
| eval new_field = if(len(test)>20,substr(test,20,len(test)),null())

[RSS_STT]

i need to truncate the string based on word count, not based on character count.

it should save truncated string (start to 25 words) into new fields.

Current which you have provided doing on character count basis.

[batabay]

Okay Than, We can use regex. Can you try this ? 

| makeresults 
| eval description = "somestring1 somestring2 somestring3 somestring4 somestring5" 
| rex field=description "(?<new_field>^\S+(?:\S+\s+){20}\S+)" 
| eval new_field_replaced = replace(description,new_field,"")
| eval description = replace(description,new_field,"")

[RSS_STT]

Looking good.  But this regex not handling the special character and digit. for example date 05/0/:2024 10:11:56.000 EST

[batabay]

I couldn't exactly understand what you're not doing with the timestamp. There are many different ways to extract the timestamp from the log. If you want to capture this field additionally, you can use \S+\s\S+.

There is example regex;

^\S+\s+\S+\s\w+\s(\S+(?:\S+\s+){1}\S+)