Eval String Function

[ezajac]

I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed.

In Python I would do something like this:

newvariable = 'blahblahblah'
newvariable[0:4]
blahb

[somesoni2]

try this

| eval newvariable=substr(newvariable,1,5)

[aelliott]

There are many examples here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf

I believe what you are looking for is "substr"