Splunk Search

Eval String Function

ezajac
Path Finder

I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed.

In Python I would do something like this:

newvariable = 'blahblahblah'
newvariable[0:4]
blahb

Tags (2)
0 Karma

somesoni2
Revered Legend

try this

| eval newvariable=substr(newvariable,1,5)

0 Karma

aelliott
Motivator

There are many examples here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf

I believe what you are looking for is "substr"

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...