How can I write a search that shows just the first N characters of each line in my logs?

[erik_paulsen]

I have logs including some very long lines. To get overview of activity, I want to write a search that shows just the first N characters of each line. What is the simplest way to do this?

[erik_paulsen · Accepted solution]

Building on richgalloway's answer, but making in more specific for people like me who are still confused by field management. To SHOW the first 300 characters of the raw search output, I found two options.

To show shortened lines in raw form:

... | eval _raw=substr(_raw, 1, 300)

To show shortened lines in table form:

... | eval x=substr(_raw, 1, 300) | table x

[richgalloway]

If your problem is resolved, please accept an answer. If you're still confused, I'd be happy to clarify.

[richgalloway]

Use substr like this. Replace 'N' with the number of characters you want to show.

... | eval field=substr(field, 1, N) | ...