How to get the first 20 characters of a field value in Splunk

[bhuvanabala]

Hi Team,

1. I have two fields called Message and Solution. Value of the Solution field is a link which i have defined that in workflow.
2. on clicking the solution it should get the first 20 characters of the Mesage field value ie. i have defined as http://xxxx:8000/XXX? form.errordesc=$Message$.Substring(0,20) in workflow.
3. But when i click on solution link i get the message value along with .Substring(0,20) ie. "hello.substring(0,20)" in Dashbaord input field

Please help me how to define substring in workflow URL

[kamlesh_vaghela · Accepted solution]

HI @bhuvanabala,

Have you tried to eval new field short_message in props.conf and use it in workflow action URL?

EVAL-ShortMessage= substr(Message,1,20)

Use this eval field in URL:

http://xxxx:8000/XXX? form.errordesc=$ShortMessage$

Thanks

[bhuvanabala]

Thanks it worked for me