Eval String Function

ezajac · ‎03-05-2014

I would like to trim down a field to 5 characters using an Excel Left Logic. I have read some suggestions to use LEN, but the length of the field is not fixed.

In Python I would do something like this:

newvariable = 'blahblahblah'
newvariable[0:4]
blahb

somesoni2 · ‎03-05-2014

try this

| eval newvariable=substr(newvariable,1,5)

aelliott · ‎03-05-2014

There are many examples here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_Quick_Reference_Guide.pdf

I believe what you are looking for is "substr"

Eval String Function

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Eval String Function

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience