Truncating results

[lemikg]

Hi there,

I am looking for a way to truncate the characters of my results.

I am doing a simple search like sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND

In the results I have many similar names like watchdog01, watchdog02, watchdog03 and so on.

Those I want to truncate to -2 characters in order to display only "watchdog"

Any help would be much appreciated.

Best regards
Mike

[martin_mueller · Accepted solution]

If you want to keep a number of characters at the start or end of a field you can do something like this:

| gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

[martin_mueller]

Just change the regular expression, this matches everything not lowercase a-z and replaces it with nothing:

| gentimes start=-1 increment=5m | eval test = replace(starthuman, "[^a-z]", "")

[lemikg]

Just out of curiousity, what command should I use if I only want to have characters (a-z) returned?

[lemikg]

i got you now ^^ thanks.

[martin_mueller]

gentimes just generates sample data for me. Put the entire query into splunk on its own, nothing before it - then understand what it does, and apply to your problem 🙂

[lemikg]

Hi Martin, thanks for the quick response.

sourcetype=ps OR sourcetype=top COMMAND | multikv | stats count by COMMAND | gentimes start=-1 increment=5m | eval test1 = replace(starthuman, "^.*(..)$", "\\1") | eval test2 = replace(starthuman, "^(..).*$", "\\1")

Doesn't seem to work in my search. It says

Error in 'gentimes' command: This command must be the first command of a search.

I am not familiar with the "gentime-command" but the search reference states that it is useful to generate time range results.

Is there another approach?