Getting Data In

Truncating results

lemikg
Communicator

Hi there,

I am looking for a way to truncate the characters of my results.

I am doing a simple search like sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND

In the results I have many similar names like watchdog01, watchdog02, watchdog03 and so on.

Those I want to truncate to -2 characters in order to display only "watchdog"

Any help would be much appreciated.

Best regards
Mike

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you want to keep a number of characters at the start or end of a field you can do something like this:

| gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If you want to keep a number of characters at the start or end of a field you can do something like this:

| gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Just change the regular expression, this matches everything not lowercase a-z and replaces it with nothing:

| gentimes start=-1 increment=5m | eval test = replace(starthuman, "[^a-z]", "")
0 Karma

lemikg
Communicator

Just out of curiousity, what command should I use if I only want to have characters (a-z) returned?

0 Karma

lemikg
Communicator

i got you now ^^ thanks.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

gentimes just generates sample data for me. Put the entire query into splunk on its own, nothing before it - then understand what it does, and apply to your problem 🙂

0 Karma

lemikg
Communicator

Hi Martin, thanks for the quick response.

sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND | gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

Doesn't seem to work in my search. It says

Error in 'gentimes' command: This command must be the first command of a search.

I am not familiar with the "gentime-command" but the search reference states that it is useful to generate time range results.

Is there another approach?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...