Splunk Search

How to find the length of the string using len(string) function

splunk_jerome
Engager

Hi,

I am trying to extract a corId from the log and find the length of the corId.
when searching am able to successfully locate the Cor Id however when evaluating its lengths, I am not able to succeed.
I used the search query as below

corId | eval length=len(corId)

the actual log file is as below:
ExecuteThread: '10' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1334795010998> < [RouteNodeAccountContactdetails, null, null, REQUEST] Header in request node of getAccountContactDetails Service:



123/wsa:MessageID

portal


10.117.215.8
123

/wsa:From
E8813354426S36
/S:Header>

<19/04/2012 10:23:25 AM EST> <[ACTIVE] ExecuteThread: '30' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1334795005278> < [RouteNodeUserDetails, null, null, REQUEST] Header in request node of getUsersDetails Service:


123/wsa:MessageID

please help.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Have you extracted the corId field yet with a field extraction?

http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsatsearchtime

Once you have the field extracted, eval with the len function is probably the way to go.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

From there you can explore doing simple stats around this field...

corId | eval length=len(corId) | stats count by length

corId | eval length=len(corId) | stats max(length) min(length) by User

Or finding searches with especially long ones..

* | eval length=len(corId) | where length>40

jakeblack
Explorer

* | eval length=len(corId) | where length>40 - perfect thank you!

araitz
Splunk Employee
Splunk Employee

Fields are case-sensitive, search is not. Try:

"corid=" | eval length=len(corid) | fillnull value=0 length | fields + length
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...