Splunk Search

Eval String Function

Path Finder

I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed.

In Python I would do something like this:

newvariable = 'blahblahblah'
newvariable[0:4]
blahb

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

try this

| eval newvariable=substr(newvariable,1,5)

0 Karma

Motivator

There are many examples here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf

I believe what you are looking for is "substr"