Splunk Search

Eval String Function

ezajac
Path Finder

I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed.

In Python I would do something like this:

newvariable = 'blahblahblah'
newvariable[0:4]
blahb

Tags (2)
0 Karma

somesoni2
Revered Legend

try this

| eval newvariable=substr(newvariable,1,5)

0 Karma

aelliott
Motivator

There are many examples here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf

I believe what you are looking for is "substr"

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>