How to find the length of the string using len(string) function

[splunk_jerome]

Hi,

I am trying to extract a corId from the log and find the length of the corId.
when searching am able to successfully locate the Cor Id however when evaluating its lengths, I am not able to succeed.
I used the search query as below

corId | eval length=len(corId)

the actual log file is as below:
ExecuteThread: '10' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1334795010998> < [RouteNodeAccountContactdetails, null, null, REQUEST] Header in request node of getAccountContactDetails Service:

123/wsa:MessageID

portal

10.117.215.8
123

/wsa:From
E8813354426S36
/S:Header>

<19/04/2012 10:23:25 AM EST> <[ACTIVE] ExecuteThread: '30' for queue: 'weblogic.kernel.Default (self-tuning)'> <> <> <> <1334795005278> < [RouteNodeUserDetails, null, null, REQUEST] Header in request node of getUsersDetails Service:

123/wsa:MessageID

please help.

[sideview]

Have you extracted the corId field yet with a field extraction?

http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsatsearchtime

Once you have the field extracted, eval with the len function is probably the way to go.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

From there you can explore doing simple stats around this field...

corId | eval length=len(corId) | stats count by length

corId | eval length=len(corId) | stats max(length) min(length) by User

Or finding searches with especially long ones..

* | eval length=len(corId) | where length>40

[jakeblack]

* | eval length=len(corId) | where length>40 - perfect thank you!

[araitz]

Fields are case-sensitive, search is not. Try:

"corid=" | eval length=len(corid) | fillnull value=0 length | fields + length